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What if there was a way to reduce your company’s IBM sean 
license fees—tesulting in thousands of dollars or more in 
monthly software savings—while automating batch 

performance and reducing demand? o 


466 MSU Reduction 


ThruPut Manager monitors your company’s RAHA—the key a 
to determining software license fees under IBM's . 
sub-capacity pricing model—and takes action as the peak 





R4HA approaches the soft cap limit, or any limit you set. seo | 

During times of high CPU usage, ThruPut Manager keeps the 

RAHA in check by prioritizing high importance batch and fale EP AMOV eet TOONS ENO IS 
ThruPut Manager client projected an 

deferring the low importance workloads. annual MLC savings of $1.9 million 


With or without soft caps in place, ThruPut Manager can reduce your MSUs and save you money. 


To learn just how much MLC you can save with ThruPut Manager, 
contact us today to obtain a customized MSU Analyzer Tool report. 





MVS www.thruputmanager.com 


solutions inc. — ThruPut Manager is a registered trademark of MVS Solutions Inc. Other trademarks are the property of their respective owner. 
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EDITOR'S DESK 





Flexible and Agile 
Environment 


ot yoga—where the room temperature is turned up 

to increase flexibility and mimic conditions found in 
India—is my favorite fitness activity. I prefer the fast- 
paced aerobic yoga style known ds power vinyasa, as it tests 
the flexibility and agility of my muscles and mind. At the end 
of the session I feel a stronger sense of personal performance, 
as if my body is as tuned and efficient as possible. 





Those same attributes can be said of Linux* on infrastructure on page 44. And meet Connor Krukosky, a 
z Systems*, and longtime supporter IBM is providing more young man installing a z890 in his parents’ basement, in 
enhancements and solutions for the open-source platform Stop Run, 48. 
for the enterprise. Like IBM’s commitment to Linux on z Systems, my 

In the cover story on page 18, find out how IBM is commitment to my yoga practice enables me to perform with 


helping customers face today’s demands in a hybrid cloud by increased flexibility and agility. As more demands are placed 
leveraging APIs and microservices on the platform. The feature onthe Linux on z Systems platform, these attributes will 

on page 22 examines the advantages of Linux on IBM z* become increasingly important. 4 

versus scale-out servers running core business workloads, and 

Currents on page 11 explains how the new IBM z13s* server A Jodo A oer 

can consolidate Linux workloads at a lower cost. 


Also in this issue, learn how IBM Multi-Factor Valerie Dennis // Managing Editor 
Authentication for z/OS* helps maintain a secure vdennis@msptechmedia.com 


CONTRIBUTORS 
© John Davi 
Gabe Goldberg saisncing = 





Nonprofit Volunteer John Davis, photographer for Stop Run on 
Gabe Goldberg, author of Stop Run on page 48, lives in his adopted hometown of 
page 48, has never resisted the siren song Baltimore, Maryland, with his wife, daughter 
of nonprofit organizations. He has given and cat. He believes that shooting only 
time to SHARE and Hillgang user groups film when he started out was integral in 
and various technology groups, served as the evolution of his creative eye and that 
an officer of his police station’s Citizens by slowing down the process of seeing, 
Advisory Committee, and enjoyed being on the mind is able to process more deeply. 
the board of directors of a small professional As a true Libra, he’s all about balancing his 
theater company. The more time and effort artistic self with his inner athlete by running 
he spends volunteering, the greater return marathons— 15 so far—and playing ice 

he experiences. hockey in a local men’s league. 
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Our simple, elegant tools bring app dev agility and speed to the powerful, 
secure and scalable z Systems platform, enabling the inclusion of the 
mainframe in enterprise DevOps. That's 


Ne Vio" Without 


Compromise 
ONLY FROM COMPUWARE. 


Visit Compuware.com to learn how our tools can help you. 








Find us on Twitter: @Compuware 





The Mainframe Software Partner For The Next 50 Years 
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Elevating Open Source for the Enterprise 


BM has long been a champion of Linux* and the collaborative environment 

for technology development it supports. We first offered Linux on the 

IBM z Systems”* platform more than 15 years ago and hdve seen its use grow 
to more than a third of our clients. 


Our commitment to Linux is 
only getting stronger as we enter 
the new era of hybrid cloud where 
organizations combine on-premises 
systems with the public cloud. Last 
year we launched IBM LinuxONE%, 
the world’s most advanced line of 
Linux OS-only systems. 

IBM also enabled new open- 
source and ISV software for 
z Systems*, including Apache 
Spark, Node.js, Docker, MongoDB, 
MariaDB and PostgreSQL. More 
than 3,000 Linux applications 
can now run on IBM z Systems. 

This year, the ecosystem for 
IBM z Systems and LinuxONE con- 
tinues to expand. We’ve optimized 
StrongLoop* and Cloudant*, 
making it easier to develop appli- 
cations and access data. We’ve 
ported the Go language to the 
system and are contributing code 
back to the community. 

In addition, the company is 
already exploring ways to use 
blockchain open-ledger technology 
on IBM z Systems and LinuxONE 
to transform the way businesses 
process and reconcile complex 
contracts and transactions. 

These advances are promis- 
ing because they eliminate the 
trade-offs many organizations had 
previously accepted. Organizations 
now have the agility and flexibility 
of open-source software along with 
the speed, scale and security of 
IBM z Systems and LinuxONE. 


The U.K. Met Office is taking 
advantage of the combination 
as it analyzes millions of data 
points each day to develop its 
forecasts. It’s using open-source 
relational database PostgreSQL on 
IBM z Systems to store and analyze 
that data. This allows the Met 
Office to lower costs while achiev- 
ing the speed and avail- 
ability required to deliver 
forecasts that help save 
property and lives. 

LinuxONE also is 
providing an attractive 
option to companies new 
to the platform. Huaxia 
Express Technology 
Development Co. is using 
LinuxONE to deliver a 
new e-ticketing solution 
for a major passenger bus 
line in China. Nanchong 
Dangdai Transport 
passengers will have the 
convenience of buying 
tickets through a website, 
mobile app or even the 
WeChat social media 
channel. The new system 
will help the transport firm 
better understand customer 
needs and trends. 


© 


ROSS A. MAURI 

General Manager, 

IBM z Systems and 
LinuxONE 
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To enable more solutions like 
these, IBM plans to continue 
an aggressive expansion of the 
z Systems ecosystem and look for 
new ways to foster collaboration. 
Earlier this year, IBM contributed 
to the Linux Foundation Open 
Mainframe Project the code for 
an anomaly detection engine 
that can help detect system 
issues and prevent failures 
before they happen. 
The LinuxONE Commu- 
nity Cloud, which provides 
test-drives of the LinuxONE 
system at no charge via the 
cloud, attracted more than 500 
developers in 72 countries in its 
first three months. It’s allowing 
developers to explore and create 
new applications with unprece- 
dented access to the platform. 
If your organization is 
already running Linux on 
z Systems, now is the time 
to start looking at new ways 
to leverage your investment. 
If you’re not running Linux 
on z Systems, encourage 
your developers to check out 
the capabilities through the 
LinuxONE Community Cloud 
(developer.ibm.com/linuxone). 
The list of open-source and 
ISV software on IBM Systems 
continues to grow, providing 
options that can help take your 
system to new levels of flexibility 
and performance. 
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INFRASTRUCTURE Intelligence 





New information about threats in the zZ/OS system improves performance 


eaders without access to accurate intelligence could eventually cause 
significant harm through their actions—or lack of timely action. 





Brent Phillips 

is the managing 
director of 
Americas for 
IntelliMagic. He 
has been working 
in IBM mainframe 
environments 

in technical and 
business roles 
for more than 30 
years, and since 
2005 in this role 
with IntelliMagic. 


Despite massive investments, 
IT and business line leaders still 
don’t have up-to-date intelligence 
about the hidden threats to 
IT infrastructure performance 
likely to harm the continuous 
availability status of their 
business applications. As a result, 
unpredicted performance and 
availability issues keep occurring. 


Increase Visibility 
Problems are often discovered 
after services for production 
applications have been 
disrupted, and IT staffers are 
forced to react in emergency 
mode without adequate 
preparation and planning. 

IT and business leaders 

can learn about upcoming 
problems through easy visibility 
into the leading indicators 
about how well technology 
infrastructure components are 


handling business application 
workloads. This way, the 
problems can be resolved 
before they impact application 
users and transactions. 

Historically, IT leaders 
have attempted to protect the 
continuous availability status 
of the technology infrastructure 
primarily through disaster 
recovery (DR) initiatives, such 
as replication and redundancy. 
While DR is critical, unexpected 
performance problems are the 
most common reason users and 
transactions are disrupted. 

The complexity of information 
system architectures and the 
less predictable nature of mobile 
users make it more difficult than 
ever for today’s reduced IT staffs 
to ensure the infrastructure has 
the performance capacity to 
handle the business workloads 
without disruptions. 


Monitor Root Causes 
Most service disruptions 

are currently considered 
“unpredictable” because today’s 
early warning mechanisms are 
triggered by problem symptoms 
such as high response times. 
These symptoms are the easiest 
metrics to monitor, but they’re 
triggered only after it’s too late to 
avoid the impact. 

Accurate intelligence is timely, 
meaning it doesn’t rely only on 
the symptoms of problems already 
occurring. It instead understands 
and monitors the underlying root 
causes of the symptoms. 

For example, infrastructure 
components that exceed the 
maximum utilization capacities are 
one of the most common causes 
of unacceptable response times. 
Timely intelligence will interpret 
the logical application workload 
metrics in the context of this type 
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of knowledge about the physical 
resources running the workloads. 

The lack of correlating logical 
workloads to physical resource 
characteristics is one of the biggest 
reasons IT leaders operate without 
good intelligence about hidden 
infrastructure threats. Once the 
root causes of a problem are 
understood, they can be quantified 
and continually monitored using 
key risk indicators to identify 
and resolve problems before 
production work is impacted. 

This approach reduces the 
false positives so common with 
status quo alerting mechanisms. 
More importantly, it also avoids 
false negatives, which occur 
when no alert is given for serious 
issues in the infrastructure that 
have not yet manifested in high 
response times—that is, the 
latent issues that are not yet 
visible as symptoms. 

The IBM z/OS* platform 
produces the world’s richest 
set of enterprise computing 
performance and configuration 
data in the form of SMF and 
RMF*. But this data remains 
vastly underutilized for the 
purpose of identifying risk within 
the mainframe infrastructure. 
Newer approaches create 
useful operational intelligence 
by automatically identifying 
anomalies and correlations in the 
data patterns. 

These approaches, however, 
are still focused on the symptoms 
of problems already occurring, 
and consequently, they only 
help staff reduce the mean time 
to recovery (MTTR) of problems. 
The ideal objective is to see and 
resolve the problem while the 
MTTR is still negative, before the 
service levels for a production 
application are ever disrupted. 

Mainframe performance 
monitors and custom reporting 
mechanisms that have been in 
use for many years can’t produce 


this kind of result. Only continual 
analysis of the logical workloads 
within the context of the physical 
resources can provide the 
answer. Mining the SMF and 
RMF data using built-in expert 
knowledge about the physical 
resources generates “availability 
intelligence,” which IT staff 

can use to plan and execute a 
strategic response. 


Productivity Increases 
When IT staffs gain access to 
accurate intelligence about 
hidden threats, they can 
identify, define and apply 
proactive performance solutions 
for business applications. 

This source of intelligence 
adds a new layer of protection 
of continuous availability at the 
primary production site. This 
new protection will prevent 
many problems that currently 
disrupt revenue-generating 
applications. Additionally, 





The IBM 
z/OS platform 
produces the 
world’s richest 

set of enterprise 


time-constrained IT staffers will computing 
be more focused on creating Potohmane Sang 
; ; configuration 
smart solutions instead of data in ihe torn 
fighting the latest fires. Not of 
only will experienced staff be SMF 
more productive, but newer and 
mainframe IT staff members RMF 
brought in to address the but this data 


remains vastly 
underutilized 


mainframe skills gap will more 
easily understand what is most 
important for performance 
and availability. 

Another benefit is that critical 
workloads run more safely 
with fewer problems, often on 
hardware that’s less expensive, 
so attempts to mitigate the risk 
of problems by overbuying 
expensive hardware is largely 
relegated to the past. 

Quantifying the risk every day, 
on every device, in every data 
center, doesn’t require an army 
of performance and capacity 
experts, nor does it require 
lengthy and expensive consulting 
engagements to study what new 
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analytics are needed and develop 
custom reports from scratch. 


Health Assessments 
The z/OS infrastructure 
configuration includes complex 
physical components from 
processors and cache to 
channels, disks and tape/virtual 
tape resources with additional 
components such as coupling 
facility or cross-system coupling 
facility in between. Logical 
infrastructure components, 

such as Workload Manager and 
synchronous and asynchronous 
replication and, in some cases, 
even automated DR swapping 
capabilities, are also critical parts 
of the IBM z Systems* ecosystem. 

Many performance and 
configuration metrics are available 
in the SMF and RMF data. 
Understanding what it means 
in terms of risk for availability 
disruptions is only possible when 
it’s interpreted automatically 
using built-in expert knowledge 
about the specific infrastructure 
components in use. The ideal 
solution will continually 
perform health assessments to 
automatically identify issues 
of unacceptably high service 
disruption risk. It will also rate 
the severity of the issue, provide 
views into the issue from many 
dimensions (physical, logical, 
changes from previous periods), 
and include recommendations on 
likely causes and how to remediate 
the risk. 

With the right intelligence 
about infrastructure availability, 
IT and business leaders can have 
the critical visibility of threats 
required to mitigate hidden 
performance and availability 
problems in the IT infrastructure. 
The result is one of the biggest 
possible advances to a top IT 
priority: avoiding unplanned 
downtime for the mission-critical 
business applications. 4 
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The new IBM z18s can consolidate Linux workloads at a lower cost 


arlier this year, IBM introduced the single-frame IBM z13s* to the z Systems” 
family. Ideal for consolidating a variety of business-critical Linux* worklodds 
in a small footprint, it supports multiple distributions (Red Hat Enterprise Linux, 
SUSE Linux Enterprise Server and Ubuntu) and Linux hypervisors (z/VM" 
and Kernel-based VM, or KVM). 


Fehmina 
Merchant 

is a senior 
consulting 
engineer with the 
IBM Competitive 
Project Office. 


This article explains what 
IBM z13s offers in terms of 
superior Linux platform and 
cost competitiveness that 
differentiates it from x86 options 
in the marketplace. 


Reliable Pairing 
The IBM z13s server is designed 
as an economical entry system 
that allows infrastructure 
consolidation and simplicity to be 
achieved with a Linux platform 
that’s high performing, reliable, 
scalable and secure. 

A fully configured IBM z13s 
system can have up to 20 


cores, operating at 4.3 GHz 
and 4 TB of memory, and is 
capable of consolidating a 
large number of workloads 
(VMs) in a single footprint. 
Each z13s system can be split 
into up to 40 LPARs to allow 
workloads to be run in secure 
isolation within these partitions 
on a single box, obviating the 
need for separate physical 
systems, as would be the case on 
competitive platforms. 

It provides capabilities 
to dynamically scale with 
Capacity on demand so it can 
nondisruptively add resources 


to support varying workload 
demands while controlling costs. 
Further, with superior workload 
management capabilities, like 
other z Systems servers, the 

Z13s enables resources to be 
effectively used by multiple 
workloads, thereby achieving 
the highest possible utilization 
of the platform. 

For years, z Systems 
mainframes have been designed 
to operate with the highest levels 
of reliability and availability, 
and the z13s is no different. 

At the hardware level, it 
ships with redundant cores, 
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On-premises Off-premises 






















One IBM z13s system: Two x86 systems: 24 virtual instances (in U.S. east): 
e8IFLs e 48 cores (24 cores per system) e 48 virtural CPUs (2 virtural CPU 
e 384 GB memory e 384 GB memory (192 GB per system) per instance) 

e KVM hypervisor running in 1 LPAR e KVM hypervisor running on e 192 GB memory (8 GB per instance) 
e Suse Linux Enterprise Server (SLES) each system e SLES as OS for instances 


as OS for workloads running in e SLES as OS for workloads running e 960 GB of persistent storage 

1 LPAR on 2 systems (20 GB per instance) 
e IBM Storwize V7000 e 1.6 TB internal SSDs (800 GB e Total data transfer out of 2154 GB/day 
e 1.6 TB SSDs per system) e Enterprise support 


24 virtual instances (2 virtual 
instances per workload): 


24 VMs (2 VMs per workload): 


e 12 VMs running WebSphere 
Application Server Network 
Deployment (ND) 


24 VMs (2 VMs per workload): 


e 12 VMs running WebSphere 


Application Server ND e 12 instances running WebSphere 


Application Server ND 


e 12 VMs running DB2 Enterprise ° eset Fi e 12 instances running DB2 Enterprise 


Server Edition Server Edition 





Includes costs to manage Includes costs to manage Includes costs to manage 
infrastructure and VMs infrastructure and VMs virtual instances 


which guarantees continuous 
availability, even in the rare 
event of hardware failure. 


Public | 24 virtual instances 
; ie 3 Cloud >} é 
memory subsystem is built-in (48 virtual cores) 


Figure 1: Cost-Effective 


Further, redundancy in the 


Off- 
using the highly available Peta ances ‘ces D}OOM (3yr TCO) 
z Systems redundant array of 
independent memory technology. 


At the hypervisor level, there's 24 General Purpose VMs__ FT ee ae 48 x86 cores 
support for live guest migration (2 VMs per workload) ; peed) Tt oS §2.95M (3yr TCO) 
to help automate and speed % Sintra ities eens 
recovery from planned and : 3 | 86 hace systems 
unplanned outages. | : 

; — 8 IFLs 
Middleware Efficiency 12 Web application workloads 

each driving 620 transactions $1 63M (3yr TCO) 
With the z13s, Linux workloads per sec; 2 VMs per workload; meee 


each VM requiring 2 vCPUs, 8GB 
memory; 20GB storage 4 5 % Less than x86 systems* 


5 5% Less than public cloud* 


"Estimated for systems compared 


can be consolidated ona 

smaller footprint at a lower cost 
compared with other x86-based ) 
options. The latest IBM total cost IBM z13s 
of ownership (TCO) study looks 


at the cost to consolidate Linux LEGAL DISCLAIMER FOR FIGURE 1 (ABOVE) AND FIGURE 2 (PAGE 14) 
workloads on the z13s compared Performance comparison based on IBM internal tests comparing IBM z13s with one comparably 
. : . configured x86 environment and one comparably configured public cloud running general 
with deploying them on-premises —_ purpose virtual machines designed to replicate typical IBM customer workload usage in the 
on the leading x86 alternative or marketplace. System configurations are based on equivalence ratios derived from IBM internal 
. : : : studies and are as follows: Public Cloud configuration: total of 24 general purpose instances; 
ee off-premises, x86-based x86 configuration: total of two x86 systems each with 24 Intel E5-2690 v3 cores, 192 GB memory, 
public cloud resources. and 2x400 GB SSDs; z13s configuration: total of 8 cores, 384 GB memory, and Storwize v7000 
For this study, it’s assumed with 4x400 GB SSDs. Price comparison estimates based on a 3YR Total Cost of Ownership 
; (TCO) using publicly available U.S. prices (current as of Jan. 1, 2016). Public Cloud TCO estimate 
there are 12 Linux Web includes costs (U.S. East Region) of infrastructure (instances, data out, storage, support, free 
workloads running 24-7. Each tier/reserved tier discounts), middleware and labor. z13s and x86 TCO estimates include costs of 
workload is a two-tier Web infrastructure (system, memory, storage, virtualization, OS), middleware and labor. Results may 
os Adi — vary based on actual workloads, system configurations, customer applications, queries and other 
application consisting of two variables in a production environment and may produce different results. Users of this document 
VMs, where one VM is running should verify the applicable data for their specific environment. 
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the front Web tier on WebSphere* 
Application Server Network 
Development, accessing data on 
the second VM that’s deployed 
with the data tier on the DB2* 
database. Each workload 

is driving, on average, 620 
transactions per second. All in 
all, 24 VMs, running a total of 12 
workloads, are defined as general 
purpose VMs, each with two 
virtual CPUs, 8 GB of 

virtual memory and 20 GB of 
virtual storage. 

Extensive benchmarks were 
conducted to determine what 
configurations are needed to 
consolidate a total of 12 Linux 
Web workloads (24 VMs) on 
Z13s servers, on-premises x86 
systems and off-premises public 
resources while meeting the 
service levels for the workloads 
in terms of desired transaction 
throughput and response 
times. In the z13s case, IBM 
consolidated the workloads 
on one LPAR using KVM with 
eight IFLs, 384 GB of memory 
and storage (IBM Storwize* 
V7000) of 1.6 TB while meeting 
all service levels. For the x86 
case, workloads were deployed 
running KVM on two x86 
systems with a total of 48 cores, 
384 GB of memory and 1.6 TB 
of storage. For the off-premises 
public cloud case, the workloads 
could be deployed on a total of 
24 instances (VMs) where each 
instance (VM) had two virtual 
CPUs, 8 GB of virtual memory 
and 20 GB of storage. 

Based on the configurations 
determined from benchmarks, 
the costs were modeled over 
three years for workloads 
consolidated on a z13s system; 
on-premises, x86-based 
systems; and off-premises, 
x86-based public cloud. 
Various cost elements related 
to infrastructure, middleware 
and labor were included in 


the overall three-year TCO (see 
Table 1, page 12). The three- 
year TCO for z13s deployment is 
estimated to be 45 percent lower 
than the compared on-premises 
x86 deployment and 55 percent 


lower than the off-premises 
public cloud alternative (see 
Figure 1, page 12). 

This case illustrates how 
lower middleware costs area 
significant advantage in the 
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case of the IBM z13s platform 
in terms of overall TCO. With 


Z13s servers, the workloads can 

be consolidated on a smaller 
footprint, which results in more 
than 4x lower middleware costs 
compared with the other two 
x86-based alternatives (see 
Figure 2, right). 

Many middleware products 
are priced per core; therefore, 
consolidating on a smaller 
number of cores (smaller 
footprint) results in lower 
middleware costs in the case 
of the z13s platform. Also, a 
consolidated and simplified Linux infrastructure (e.g., with multiple consolidating a variety of Linux 


Figure 2: Efficiency 


Public cloud x86 systems IBM 213s 





infrastructure on z13s results in servers) needs to be managed. workloads at an economic price 
lower labor costs (in managing point, which will be difficult to 
the infrastructure) compared Competitive Price Point find in competing x86-based 
with an on-premises, x86-based The IBM z13s offers a superior alternatives or public cloud 
environment where a larger enterprise-grade platform for solutions. 4 





See 
SUMMER WITR 


SHARE 


EDUCATE > NER eae INFLUENCE 


SHARE © 
Atlanta 2016 ©© 








new! {0 






SHAREACADEMYS {[ivel 





gystem 


VISIT SHARE.ORG/ATLANTA FOR MORE INFORMATION. 


14 // MAY/JUNE 2016 ibmsystemsmag.com 


ILLUSTRATION BY MARK ALLEN MILLER 


FOCUS ON STORAGE 











BEYOND Traditional Storage 


IBM Spectrum Storage Suite offers a new way of licensing storage software 





ccording to IDC, by 2018, storage-rich servers are expected to account for 

half of new capacity purchased’. After 18 months of working in the software- 
defined infrastructure (SDI) landscape, early adopters have developed a strong 
preference for single-vendor solutions. With the breadth of the IBM Spectrum Storage” 
portfolio, a logical next step for IBM was to enhance its SDI portfolio with the creation 
of IBM Spectrum Storage Suite. Its design is based on IBM's Virtual Storage Center 
(VSC) offering, which combines IBM Spectrum Control* and IBM Spectrum Virtualize” 
solutions running on the SAN Volume Controller appliance. 








Nick Haris IBM Spectrum Storage Suite reduction technology, software or storage for new workloads, 
is the storage 18 not just a simplification management and transition where the actual physical storage 
team leadinthe of contracts, policies and vehicles that can be applied to location can be in private, public 
BM Competitive procurement that comes with a the traditional storagelandscape __ or hybrid clouds. 
Project Office. , . . 
bundle. It’s a far more disruptive 
: : ' Storage-rich server estimated growth source: Natalya Yezhkova, “Worldwide 
eee of use cases that includes Enterprise Storage Systems Forecast, 2015-2019,” Doc # 256302, IDC, May 2015. 
appliance software, data idc.com/getdoc.jsp?containerld=256302 
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A year after the announcement of the IBM Spectrum 
Storage family, the interest in SDI is high. In fact, 

IBM is seeing 60 percent of clients involved in 
early adoption committed to investing in this new 
technology. According to an ESG Research report, if 
we add clients expressing interest, we can grow the 
potential SDI community to over 80 percent’. 

This increased SDI desire is fueled by the rapid 
adoption of big data, analytics, mobile and cognitive 
workloads by many enterprises as they look to expand 
their knowledge and business advantage. Clients 
are building data gathering and transformation 
environments, and seeing a change in the form of 
storage. As they start to outgrow traditional storage 
silos in the IT landscape, storage-rich servers are 
being defined by the new SDI workloads as the data 
target of choice. 


The Suite Life 
The software suite experience is not new to IT 
landscapes. Back in 1988, Microsoft* launched its 
first bundled application suite, Microsoft Office, which 
contained Word, Excel and PowerPoint. By doing 
so, it effectively created a software-defined desktop. 
Many have since copied this idea in various areas of 
the IT environment. Packaging applications in a suite 
doesn’t prevent a la carte selections; it just delivers 
consistency across users and simplifies the operation 
and maintenance. Just like the rest of IT, this bundle of 
Microsoft Office applications is available in the cloud 
or as a hybrid environment. 

The IBM Spectrum Storage family includes six software- 
defined storage products that can now be brought together 
as a Suite of software: 


e IBM Spectrum Accelerate* 
e IBM Spectrum Archive* 

e IBM Spectrum Control 

e IBM Spectrum Protect* 

e IBM Spectrum Scale* 

e IBM Spectrum Virtualize 


IBM Spectrum Storage Suite licenses are avail- 
able as either a perpetual or monthly pricing 
model. The two models can also be combined to 
form what is called a utility licensing model (see 
Figure 1, above). 

For example, a client with 500 TB of storage-area 
network (SAN) storage and 500 TB of storage-rich 


2 Adoption and interest in SDS source: Mark Peters, ESG 
Research Report, “2015 Data Storage Market Trends,” 
October 2015. 
esg-global.com/research-reports/ 
2015-data-storage-market-trends/ 
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The capability to deploy different 
components of the IBM Spectrum Storage 
family with ease means the development 
and operations teams can look forward to 
simplified testing and fluid deployment 

of storage for new business solutions. 


servers would license 1000 TB of 
IBM Spectrum Storage Suite. This 
provides 500 TB of a Spectrum 
Virtualize license, which 
contains virtualization (including 
external virtualization), 
IBM Real-time Compression’, 
FlashCopy* and IBM 
Remote Mirroring (including 
WAN acceleration). 

The same client could 
also deploy 1000 TB of 
Spectrum Control software 
to manage this complete 
environment at no additional cost. 
Spectrum Storage Suite licensing 
is tied to the amount of usable 
physical storage being software- 
defined, not to the capabilities 


or products being deployed. 

IT managers have complete 
flexibility to deploy whatever 
combination of Spectrum Storage 
products are necessary to get 

the job done. The combination 

of Spectrum Virtualize and 
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Spectrum Control software 
includes significant data 
reduction technologies the client 
can utilize. 

If we assume the client could 
reduce its 500 TB of managed 
SAN storage to 400 TB using this 
technology, 100 TB of managed 
storage would be available for 
the existing Spectrum Accelerate 
storage-rich server environ- 
ment or a new Spectrum Scale 
or Spectrum Protect project. 
This capability is a unique 
and important aspect of the 
Spectrum Storage Suite license, 
which enables clients to evolve 
their storage landscapes to meet 
the demand as they introduce 
new workloads. 


Helping Clients Evolve 
The IBM storage SDI model pro- 
vides clients with straightforward, 
per-TB pricing related to their 
storage capacity for the entire 
suite—regardless of storage in 
use, in most cases. This licensing 
model is especially relevant when 
the client landscape is evolving 
and migrating from one storage or 
data type to another. 

As this suite construction 
includes many products 
and features from the IBM 
Spectrum Storage portfolio, it 
also includes a “no software 
licensing hassle” to introduce 
these features, removing the 
worry of unexpected charges 
when attempting to use 
new capabilities. 

The capability to deploy 
different components of the 
IBM Spectrum Storage family 
with ease means the develop- 
ment and operations teams can 
look forward to simplified testing 
and fluid deployment of storage 
for new business solutions. 

The IBM Spectrum Storage port- 
folio provisions a consistent UI 
across offerings, which further 
simplifies IT support. 4 
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Linux on z Systems enables the API economy and 
microservices while enhancing hybrid cloud solutions 


By Shirley S. Savage ® Illustration by James Dawe/ycn.org 


usinesses are looking for 
i technology that helps 

them stay relevant, 
flexible and secure in the 
digital economy. As a result, 
companies are turning to Linux* 
on z Systems* to take advantage 
of the platform’s open-source 
technology that provides 
flexibility to meet 
today’s challenges. 

Recent acquisitions and 
innovations from IBM support 
open source and provide 
opportunities to leverage APIs 
and microservices as well as 
enable enterprises to effectively 
use hybrid cloud environments. 

With foundational investments 
in Linux and Eclipse, IBM 
has supported open source and 
open standards for nearly two 
decades, notes Marcel Mitran, 
Distinguished Engineer and 
CTO of IBM LinuxONE*. IBM 
is also a founding member and 
strong supporter of several 
key open-source initiatives, 
including OpenStack, Cloud 
Foundry, Node Foundation and 
Apache Spark. 


“The Linux on z Systems 
platform continues to be a presence 
in these and many more open 
projects, allowing IBM z* users to 
leverage open innovation while 
benefiting from the underlying 
platform’s advantages in security, 
resilience, response time and 
scale,” Mitran says. “There’s a 
unique elegance to having the 
platform address these concerns.” 

Other platforms require 
heroic effort in the application 
and operation layers to enable 
security, scale and resilience, 
Sapping energy and organizational 
focus from the business’s core 
competencies and interests. But 
with Linux on z Systems, those 
advantages are built in, he notes. 

Many enterprises use hybrid 
clouds to improve ROI. However, 
the ROI advantage can be lost if the 
hybrid cloud isn’t secure. Seventy 
percent of enterprises investing 
in hybrid clouds are faced with 
increased security concerns. 

With strong cryptography 
performance and an 
extended suite of capabilities, 

z Systems provides security at 


scale for hybrid clouds. IBM has built a rich ecosystem 
on z Systems with products like QRadar*, which 
manages and alerts clients to security threats, and 
IBM Security zSecure*. IBM Security Guardium* 
leverages analytics for data integrity monitoring. 

IBM has partnered with BlackRidge Technology, 
Forcepoint Trusted Thin Client and RSM Partners to 
broaden the z Systems security portfolio. 


Co-Location Benefits 

Linux on z Systems hybrid cloud offers other 
advantages, such as co-locating with the system 
of record, which allows for smoother and faster 
performance. Application response times are up to 
3x faster when the insights and engagement layers 
are co-located with the data. 


CSN 


e Linux on z Systems brings together 
open-source technology with an 
enterprise-grade system. 


e IBM has recently made many investments 
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Transactions bound by fixed 
service-level agreements 
benefit immensely from 
co-location. When the 
systems processing 
the transaction don’t 
wait for the data to 
move between discrete 
machines, more time 
exists for analytics to 
capture and develop 
insights that can provide 
more powerful engagement and 
an improved experience for the 
end user, Mitran notes. 

In terms of security, co- 
location reduces points of failure 
and attack vectors, which can 
result in better availability and 
security at a lower cost. 

The February study by 


Solitaire Interglobal—“Cyber crime: 


Keeping data safe from security 
incursions” (ibm.co/1qkn1iw)— 
shows that z Systems requires 
70 percent fewer tasks than x86 
or UNIX* to implement standard 
protection levels, Mitran says. 
Therefore, securing assets on 
z Systems is 84 percent cheaper 
than on x86 or UNIX platforms, 
according to the study. 
Co-location provides data 
center savings, too. Co-location 
and the resulting consolidation 
within the data center can 
yield a reduction in power 
usage and shrink the data 
center’s footprint. 







applications may benefit from running Ubuntu— 
Canonical’s open-source platform. 

As acloud-enabled distributor, Ubuntu’s footprint 
claims 70 percent of OpenStack-enabled systems, 
70 percent of public cloud images and 70 percent of 
Docker Hub images, Mitran says. It also has become 
the de facto standard distribution used by computer 
science and engineering graduates, he notes. 

With capabilities like Juju, Metal as a Service, 
Landscape and LXD, Ubuntu brings a rich set of 
innovative and popular cloud enablement and 


application development tools to Linux on z Systems. 


“When coupled with the scale, availability and 
security that have made z Systems the platform of 
choice for some of the most demanding mission- 
critical systems in the world, the outcome is a very 
powerful value proposition,” Mitran says. 

Further, thanks to a common set of capabilities 
for both edge computing and back-end systems, 
Ubuntu’s support of the Internet of Things (IoT) and 
public cloud environments provides a seamless end- 
to-end experience for hybrid cloud solutions. 


IBM and the API Economy 


As well as partnering with companies like 


“The Linux on z Systems 

platform continues ... allowing 
IBM z" users to leverage open 
innovation while benefiting 
from the underlying platform ’s 
advantages in security, resilience, 
response time and scale.” 


—Marcel Mitran, Distinguished Engineer and CTO of LinuxONE 


API Economy, IBM, and former 
StrongLoop CEO. 

Node.js is the most popular 
open-source framework available 
today. Its ecosystem has over 
250,000 modules available for 
developers to use to create new, 
highly scalable applications, 
Soto says. Typically used for 
applications that must excel 
at handling many external 
connections simultaneously, 
Node.js is ideally suited for 
an enterprise’s API tier. Many 
technology innovators take 
advantage of its unique 
technical advantages, rapid 
development capabilities and 
vibrant community. 

With the acquisition of 
StrongLoop, IBM is expanding 
the category of API management 
solutions to not just secure 
and manage APIs but also to 
create and run APIs to deliver 


How Ubuntu Canonical, IBM is acquiring businesses that an unparalleled, integrated user 
Adds Value offer synergies with existing IBM products and experience supporting the full 
IBM’s partnerships with expand services for customers, such as APIs API lifecycle. 


open-source providers enable 
clients to fully explore the 
hybrid cloud and its business 
advantages. For instance, 
customers using Linux on 

z Systems for hybrid cloud 


and microservices. 

In September 2015, IBM acquired StrongLoop”*, 
the leading provider of enterprise Node.js, an open- 
source technology that helps enterprises create, 
run, manage and secure APIs, explains Juan Carlos 


Soto, vice president of Hybrid Cloud Integration and 


Node.js is expanding 
opportunities for Linux on 
z Systems developers on the 
innovative edge of open- 
source technology. Developers 
are seeing the advantages 
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of running APIs close to the 
data source itself, Soto says. 
Node.js runs 2x better on 

Linux on z Systems than on 
competitive platforms. Further, 
when Node.js is co-located with 
data and transactions native on 
z Systems, the system sees a 60 
percent reduction in response 
times and 2.5x improvement 

in throughput. 

“These statistics point to the 
power of running Node.js and 
implementing performance- 
critical APIs right on Linux on 
z Systems,” Soto notes. 


API Connectivity 
To bring IBM and Node.js 
synergies together, in March, 
IBM released IBM API Connect*, 
which integrates IBM’s API 
management and gateway 
offerings along with API creation 
and runtime capabilities using 
StrongLoop’s Node.js and IBM’s 
Java* technologies. 

“This enables companies 
of all sizes to create, run, 
manage and secure APIs that 
access information on existing 
IT systems, including the 
mainframe or anywhere in the 
back office as well as services 


and data in the cloud,” Soto says. 


“It also enables high developer 
productivity using Node.js to 
create new APIs.” 

With its built-in, integrated 
support for both Java and 
JavaScript* (the programming 
language used by Node.js) for 
API development and execution, 
IBM API Connect is the only 
API solution on the market that 
covers the two most popular 
programming languages ina 
single offering, Soto notes. 

APIs allow applications to 


interact with each other and serve 
data and services to mobile, rich 
Internet applications and IoT 
devices. APIs allow component 
services to be moved elsewhere 
in the cloud without breaking the 
overall solution, Soto says. As 
long as the solution uses APIs to 
integrate the component services, 
their interfaces remain consistent 
even as their implementation or 
execution locations change. 

APIs also enable businesses 
to tap new revenue streams. 
Enterprises can leverage their 
existing IT investments and 
the services those investments 
create to drive revenue growth 
and expand into new business 
areas. For example, a bank can 
offer APIs to Web and mobile 
businesses, allowing them to use 
its banking APIs for transactions. 
“You are getting the advantage of 
driving new usage and creating 
new business opportunities from 
services you’ve built over the 
years,” Soto says. 

Companies offering APIs for 
external access can make them 
freely accessible to drive as much 
penetration and adoption as 
possible, or control access to the 
APIs to bill for their usage or for 
security reasons. 

“A powerful API manage- 
ment platform, such as 
IBM API Connect, not only 
allows you to create and run 
APIs but also manage those 
APIs by defining access policies 
from the start,” Soto notes. 
“Then, with solutions from 
IBM, such as IBM DataPower* 
Gateway, you can seamlessly 
enforce those data policies 
directly in the gateway 
without requiring 
additional programming.” 








Ubuntu is a 
cloud-enabled 
distributor with 
a footprint that 

claims 


70 percent 
of Open- 
Stack-enabled 
systems, 
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of public cloud 
images and 


70 percent 
of Docker Hub 
images 


Node.js runs 


2x 


better on Linux 
on z Systems 
than competitive 
platforms. 
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Node.js is co- 
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The Rise of 
Microservices 
Individual APIs can also be used to 
create a new API tier to handle the 
evolving demands from mobile, 
rich Web and IoT. Many enterprises 
are creating such an API tier on the 
edge of their enterprise network. 
Rather than directly accessing 
data and services spread among 
systems of record and in the cloud, 
an API tier enables enterprises to 
combine and optimize service and 
data access, increasing overall 
performance, controlling access to 
back-end systems and improving 
overall reliability. 

The API tier is increasingly 
implemented as a collection 
of microservices—each with 
a modular, highly specific 
function—exposed as managed 
APIs to systems of engagement. 
From there, developers can 
quickly aggregate and optimize 
APIs to deliver the critical 
Services powering innovative 
applications accessed by 
customers,employees or partners. 

“APIs enable companies to get 
into new business areas, protect 
their existing ones, and deliver 
a better experience to their 
customers, their partners and 
their employees,” Soto says. 


Providing Services 
Linux on z Systems supports, 
enables and advances hybrid 
cloud, the API economy and 
microservices as well as the 
business benefits these services 
provide. This allows your 
business to stay competitive 
and thrive in this ever-changing 
environment. 4 





Shirley S. Savage is a Maine-based 
freelance writer. 
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Businesses see an advantage to using Linux on z Systems 
over scale-out servers 


he IBM z Systems* 

mainframe is well 

established today as the 
invaluable system of record (SoR) 
for mission-critical business data 
and applications. It has evolved 
over the past several decades to 
be the IT centerpiece of many 
of the largest banks, retailers, 
financial firms and healthcare 
companies in the world. 

Millions of other servers are 

also in use. Server sprawl— 
driven by huge numbers of 
inexpensive, scale-out servers— 
has increased at a phenomenal 
rate. Since the introduction 
of virtualization in the mid- 
2000s, the number of VMs 
supported on those servers has 
also grown, with IDC reporting 
that x86 servers are nearing 
VM saturation (bit.ly/1LxnulL). 
Although today’s most critical, 
complex and compute-intensive 
workloads are candidates for 
virtualization, these workloads 
also have ever more stringent 
requirements for performance 
and service delivery. 


For instance, analytics 
workloads support large 
databases yet must also meet 
demand for real-time response. 
Large clusters of scale-out 
servers generally don’t have the 
sustained performance capacity 
or large-scale memory and cache 
requirements to adequately 
drive these workloads—database 
sharding (partitioning) has 
become popular as a way 
around this issue—and the 
vast network connectivity 
requirements introduce even 
more latency. Mobile workloads 
not only put unexpected and 
unpredictable performance 
strains on IT servers, but they 
also demand exceptionally fast 
response times. As businesses 
move beyond simple mobile 
connectivity and into the API 
economy, co-location of systems 
of engagement (SoE) services 
with SoR assets becomes critical 
to maintain immediate response. 

A better solution is Linux* 
running on z Systems. 

IBM z* provides exceptional 
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e Linux running on z Systems is a better 
solution than scale-out servers to run 
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up utilization and reduce core requirements, 


thus lowering software costs. 
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performance and service delivery 
to efficiently drive large workloads 
as well as consolidate large 
numbers of smaller workloads. 

In addition, when running Linux 
on IBM z co-located with z/OS*, 
hybrid workloads that span the 
SoE/SoR boundary run with 
highest efficiency, and often with 
lower cost. 
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Performance and 
Service Delivery 

IBM z Systems servers are far 
more powerful than typical 
scale-out models. Mainstream 
Intel* cores support clock speeds 
of roughly 2.3 to 3.5 GHz, while 
IBM z13* cores deliver 5.0 
GHz—the fastest commercially 
available—and IBM z13s* cores 
run at 4.3 GHz. The z13 tops out 
at 10 TB of memory, with the z13s 
capable of 4 TB. Each IBM z core 
has over 4.3x more on-chip cache 
per core than an Intel core. IBM z 
also has shared L4 cache, which 
doesn’t exist on Intel chips. 

The impact of clock speed, 
memory and cache differences 
means that data-driven, cache- 
intensive, compute-intensive 
workloads run faster on Linux on 
IBM z than on x86 servers. 

Database workloads are by 
nature very cache-intensive. IBM 
engineers ran a pure memory 
database access test on an IBM 
Z13 with six cores running Linux. 
The same test produced virtually 
the same results on an x86-based 
server but required 80 cores. 
Because the test ran with so 
many fewer cores on the z13, the 
database software was calculated 
to be 6.7x more expensive on the 
x86 server than on Linux on z, 
according to IBM. 

In another example, engineers at 
IBM Research have recently done 
medical-related data modeling, 
looking for breakthroughs in 
disease prevention and control. 
Typically, these studies use huge 
amounts of data and involve 
compute-intensive algorithms. 
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When running these studies on 
large clusters of x86 servers, 

the data must be partitioned 
horizontally across the servers, 
and the test itself may take over a 
week to run because of repeated 
sharding and merging of the data. 
Alternatively, the researchers found 
the tests could be run in less than 
an hour on Linux on z Systems, 
primarily because the large cache 
and memory on the IBM z13 
eliminated the need for sharding, 
and the faster clock speeds ran the 
computations faster. 

Linux on IBM z is also 
supported by an exceptional I/O 
system, supporting about 80x 
more I/O channel processors than 
typical x86 servers. This means 
I/O intensive workloads also run 
faster and more efficiently on 
IBM z. Using data from a customer 
proof of concept, IBM showed that 
the database workload required 
432 cores when running on an 
x86 cluster, but only 61 IFLs 
when running on Linux on IBM z. 
The configuration was calculated 
to have a 54 percent lower cost 
of acquisition. 

Unlike scale-out servers, IBM z 
is designed with multiple levels 
of virtualization, efficiently 
supporting large numbers of 
business workloads, all in one 
box. The IBM z13 platform can 
support up to 85 LPARs, and 
the z13s up to 40. Each LPAR 
is completely isolated from the 
others, with the PR/SM* partition 
management functionality “baked” 
into the firmware. Common Criteria 
rates PR/SM as EAL5+, higher 
than any other commercially 
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available hypervisor. Each LPAR 
can optionally run its own 
software hypervisor (z/VM* or 
Kernel-based VM), with each 
hypervisor instance supporting 
upward of 50 VMs running 
Linux. Additionally, PR/SM on 
IBM z is exceptionally efficient 
at managing system resources, 
ensuring high priority workloads 
in one LPAR will deliver to 
service levels, even if lower 
priority workloads are running 
in neighboring LPARs. IBM has 
shown that the leading x86 
hypervisor can’t match this 
service delivery when running 
mixed priority workloads in 
neighboring VMs. 

IBM z is designed for resources 
(e.g., CPUs, memory, I/O, etc.) to 
be added dynamically without 
disruption to the running 
environment. This allows for a 
Linux platform that can scale 
both horizontally (new Linux VMs 
can be added as resources are 
added) and vertically (resources 
are added to an existing VM) (see 
Figure 1, page 25). 

These capabilities add up to 
some impressive numbers—the 
platform is capable of driving 
thousands of Linux VMs and 
massive Linux workloads with 
thousands of users. 

An IBM z13 running Linux was 
shown to support the largest single 
node of MongoDB, with a footprint 
of more than 1 TB, sustained fetch 
times of under 5 milliseconds and 
the processing of over 2 billion 
documents. Because this is a single 
massive node on the z13, sharding 
isn’t necessary. 


As evidenced by numerous 
real-world use cases, IBM z can 
support consolidation of hundreds 
of commodity scale-out Linux 
servers, with core ratios averaging 
around the order of 10-to-1. 


Co-Location Advantage 
Today’s digital business workloads 
are frequently hybrid in that 

they have multiple components, 
typically serving SoR and SoE 
functionality. With scale-out 
servers, the components must 
Span across multiple physical 
servers. On IBM z, they can run 

in neighboring LPARs, which is 
more advantageous because there 
is no physical network. LPAR-to- 
LPAR communication is done at 
memory speed over the internal 
HiperSockets* LAN built into the 
system. There’s no overhead of 

a physical connection, thereby 
minimizing latency, and no 
physical exposure to potential 
security threats. This mode of 
communication is also transparent 
to the applications running. 

IBM has demonstrated 
the advantages of co-located 
hybrid workloads using the 
IBM MobileFirst* Platform 
Foundation (MFPF) server—which 
runs on Linux—and a mobile- 
driven workload. When the MFPF 
server was co-located on Linux 
on z Systems with a z/OS-based 
CICS* core banking back end, 
the throughput transaction rate 
was twice that of when the MFPF 
server ran on a separate x86 
server. The co-location case also 
delivered 31 percent lower cost 
per transactions per second. 

In another test, an online 
transaction processing (OLTP) 
database was set up in a Linux on 
z Systems LPAR. An Apache Spark 
application was developed to run 
analytics queries against that 
database. The Spark queries were 
run from a separate x86 server as 
well as in a co-located LPAR on the 


Figure 1: IBM z Scaling Support 
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same server as the OLTP database. 
IBM found that Spark running on 
IBM z with the database drove up 
to 3x more throughput than when 
Spark ran off of the platform on 
the x86 server. 


Economic Benefit 
One of the best methods for 
comparing different platforms 
is total cost of ownership (TCO), 
where hardware and software 
acquisition costs are coupled 
with factors like labor, facilities 
and power, networks, storage, 
non-production environments, 
growth plans, migration costs, 
availability requirements and 
extra security requirements. 
Infrastructure costs are often 
thought of as the most expensive 
part of TCO, but software costs— 
especially when priced per core— 
are often the steepest. 
Large-scale consolidation on 
IBM z will drive up utilization and 
reduce core requirements, thus 
lowering software costs. In-house 
case studies have demonstrated 
this. A total of 123 variable 
workloads required 264 cores on 
11 x86 servers, producing a three- 
year TCO of $10.6 million. On an 
IBM z13 system running Linux, 
these workloads required only 32 
cores, resulting in a three-year TCO 
of $7.2 million, or 32 percent less. 
Even though the infrastructure 
costs of the z13 platform were 
about 5x more than the x86 


- or clone more Linux guests with a high degree 
of resource sharing 





servers, the substantial reduction 
in cores led to a 72 percent 
reduction in software costs, which 
brought down the entire TCO. 


Well-Rounded System 
It’s clear that Linux on IBM zis an 
outstanding alternative to scale- 
out x86 servers: IBM z is supported 
by standard distributions from 

Red Hat, SUSE and Canonical 
Ubuntu; over 3,000 Linux 
applications (e.g., Oracle 
database) from hundreds of ISVs 
are available for the platform; anda 
wide array of open-source software 
is supported. Furthermore, IBM 
internal testing has shown that 
Linux on z Systems outperforms 
x86 servers in a variety of 
middleware tests. 

It is also a better choice than 
scale-out x86 servers for large 
cache- or I/O-intensive workloads 
like database applications or 
transaction processing, or for 
consolidation of large numbers 
of low utilization servers. Co- 
locating hybrid workloads on 
IBM z also typically delivers 
faster throughput and reduced 
costs. Lastly, with mixed 
workload environments, Linux 
on z Systems often delivers lower 
software license costs and overall 
lower TCO. 4 





Emily Farmer is a z Systems 
evangelist in the IBM 
Competitive Projects Office. 
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Mobilepnobia 


CISOs can mitigate common mobile security fears 
and prevent issues in the workplace 


human resources 
A director forwarded 

some W-9 forms from 
his smartphone, but he sent 
them to the wrong person. An 
accounting manager’s new 
tablet was stolen—right after 
she downloaded financial data 
for an upcoming meeting. A 
communications coordinator 
accidentally posted photos 
from his bachelor party to his 
company’s Facebook page. 








These scenarios would mean 
a bad day at work for just about 


anyone, but especially for a CISO. 


As more employees bring their 
own devices to and from the 
office, many CISOs suffer from 
an increasingly common anxiety 
disorder: mobilephobia. 

IBM’s e-guide, “Mobilephobia: 
Curing the CISO’s Most Common 
Mobile Security Fears,” delves 
into the worries and realities 
surrounding mobile security 





A mobile device 
is wiped every 


3 minutes 
as part ofa 
corporate 
security policy 


in the workplace. Jason Hardy, 
market segment manager for IBM 
Mobile Security and an author 

of the e-guide, explains the key 
takeaways CISOs can enact to 
improve mobile security. 


The Harsh Reality 
Every three minutes, a mobile 
device is wiped as part ofa 
corporate security policy, 
according to a recent study by 
MaaS360 (bit.ly/1VVRduu). 
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You never know who exactly will get 
access to your system dumps. Just one dump 
in the wrong hands is enough to expose your 
company — or even country -— to significant IT risks. 
If your mainframes are outsourced, ask yourself: 
how is your provider handling your sensitive data? 


Given the new threats, it’s time to update our 
thinking and make these practices more secure, after 


Anonymize Them Now! 
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decades of ignoring the risks. Get serious about your 
data center’s new security and integrity obligations 
regarding system dump and log anonymization, and 
safeguard your SOX, PCI, DISA STIG, NIST 800-53, 
FISMA and HIPAA compliance. 


allows you to address this threat 
easily, properly and cost-effectively. It works, it’s 
patented, and it’s easy to install and use. 
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The same study revealed that 
businesses of all industries 
and sizes are clearing data 
from mobile devices to manage 
security concerns. 

These facts show that CISOs 
have a good reason to be 
anxious. As the lines continue 
to blur between professional 
and personal mobile devices, 
new risks and threats to security 
arise. Unlike many phobias, 
mobilephobia is based on 
rational worries. 

“We’ve been securing laptops 
and had a clearly defined 
perimeter for years,” Hardy says, 
“but now there are all of these 
new devices that haven’t been 
secured. Millions of people are 
using smartphones and other 
mobile devices, which means 
there are millions of new targets. 


93 


In any given organization, 
the CISO may be struggling to 
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manage and control hundreds 

or thousands of mobile devices. 
With those mobile devices come 
numerous OSes, most of which 
are upgraded on a regular basis, 
and often before the CISO has 

an opportunity to certify them. 
In addition to the OS, end users 
are constantly downloading new 
software applications that haven’t 
gone through the company’s 
security testing processes. 

“Laptops were typically 
company-owned, and we were 
able to lock them down and 
manage them,” Hardy says. “But 
mobile devices are often owned 
by end users—and they hold 
the keys to adding and 
upgrading applications.” 

To complicate matters, the 
providers of mobile OSes actively 
promote new releases. “All you 
have to do is push a button and 
there you have it,” Hardy notes. 
“So, suddenly, the CISO has users 
who can put anything on their 
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If your organization is facing new security and compliance 
requirements, you're probably bracing for impact. Thousands 
of FTP jobs to be edited and changed to SFTP command 
syntax. Hundreds of hours of tedious work and additional 


training. 


Or... you can leave everything to VitalSigns for FTP (VFTP) and 
SSH/Tectia, a solution that makes the migration from FTP to 
SFTP seamless and automatically converts FTP to SFTP. 


This integrated SFTP solution enriches your system with 
transparent monitoring and auditing capabilities that meet 


today’s toughest compliance standards, including SOX, 


VitalSigns™ for FTP and 
SSH are saving us a 
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combined solution on 
the market—period. 
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(Sarbanes-Oxley Act), GLBA (Gramm-Leach-Bliley Act), PCI 
DSS (Payment Card Industry Data Security Standard), HIPAA 
(Health Insurance Portability and Accountability Act). 


From an intuitive browser interface, users can automate and 
control batch processes, drop in security, encryption and 
authentication protocols, and closely monitor FTP traffic on 


your TCP/IP network. 


VitalSigns for FTP is brought to you by SDS. Since 1982, Software 
Diversified Services (SDS) has provided several hundred enterprise 





clients worldwide with the highest quality mainframe software, 
documentation, and technical support. We are an IBM “Partner in 





Development” and an advanced member of IBM PartnerWorld®, 


device, do it cheaply and bypass 
any enterprise controls.” 

A security policy that 
requires that updates be 
pushed out automatically 
versus left up to each user is 
essential. This “over the air” 
policy also must identify and 
remediate devices that may be 
at risk, track who is requesting 
sensitive data and automate the 
appropriate solution. 

Theft is another common way 
devices become “rogue.” Rather 
than treating lost or stolen 
devices as an exception, they 
must be incorporated into the 
overall security plan. According 
to the e-guide, this starts with 
encryption when the device is 
commissioned. It also entails 
additional data protection for 
information added to the device 
as well as the ability to search for 
the device and render it harmless 
if it’s lost. 
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representing the single largest 
form of mobile security breach.’ 





To achieve the proper work- 
life balance, it’s important to 
separate our professional lives 
from our personal lives. The 
same goes for mobile devices. 
Sometimes the biggest security 
threats occur when threats from 
personal-use apps mix with 
official business. 

“For instance, I wouldn’t want 
somebody taking my business 
content and forwarding it out 
through their Yahoo or Gmail 
account,” Hardy says. “But it 
happens all the time.” 

Enter the “corporate 
sandbox.” By creating two 
separate, logical partitions, 
it’s easier for organizations to 
manage email, attachments 
and interaction among work 
and personal email accounts. 
Through this approach, 
organizations can stop users 
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“You have all of this information coming 
in—millions of records—and somewhere 
in those records could be information 
pointing to a malicious attack. How do 
you find that one needle in the haystack?” 


—Jason Hardy, market segment manager, IBM Mobile Security 


from forwarding attachments 1.6 million apps in the leading 
from corporate email systems. app stores. At the same time, 
It’s also easier to enforce Apple’s store offered 1.5 million 
authentication of the deviceand apps for download. 

stop data loss and leaks. It’s nearly impossible to tell 


how all of those applications were 
developed. And, unfortunately, 


According to Statista app breaches are one of the 
(bit.ly/1oNiPaL), as of July 2015, most common methods of 
Android users could download hacking into a mobile device. 


Lower the Risk 
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Curing the CISO's Most Common Mobile Security Fears" 
provides some tips. The process should include these 
common elements: 


Encrypt the device: This may seem obvious, but many 
bring-your-own devices are not encrypted. The enrollment 
process must include encryption. 
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logical distinction between the two “personalities” provides 
greater protection. 


No enrollment/no access: [he key is not to position 
idat=mante)e)|(-ms\-(e16] qiavmant=lal-(e(=1aa(- 1pm cele) \owr-\omra(-mue-1i | (emere) e<) 
between users and information but to make the enrollment 
process unobtrusive and simple so it happens even when 
users aren’t forced to run scripts or download software. 


Develop an “information architecture”: Know 
what information must be protected at all costs and 
what information is less sensitive. 








A lot of people are watching your 
DB2 and IMS data 24/7... 








We make sure one of them is you. 


4ay_—«COne of the core tenets of mainframe security software is visibility. With CorreLog 
A a” dbDefender™ DAM' Agent for z/OS, we help you keep an eye on your most sensitive DB2 
and IMS data 24/7/365. dbDefender™ DAM Agent monitors DB2 and IMS user accesses 
and in real time, delivers alerts directly to your Security Operations Center (SOC) or SIEM when 
anomalous activity occurs. doDefender™ DAM Agent helps you keep tabs on your most sensitive 
mainframe data, and does it in real time: 


> Privileged User Activity monitoring, alerting and reporting 
> Collects real-time event messages for all user access activity, and records an audit trail 


> Audits all valid and invalid attempts to access sensitive datasets — SSNs, Credit Cards, etc. 


> Creates an audit trail of all data access and tracks changes to data structure, content or 
authority. Audits all DDL, DML, DCL and TCL SQL statements. 


> Event messages are exported, in real time, to distributed Syslog format for your SIEM. 


Learn more about dbDefender™ DAM Agent for z/OS at CorreLog.com or stop by for a LIVE DEMO at 
IDUG North America (Booth #300), in Austin, Texas, May 23-26. 


‘Database Activity Monitoring 


Real-Time DB2 & IMS Security Auditing from CorreLog dbDefender™ DAM Agent 





mf 
| : 
hata f CORRELOG 
CorreLog is proud to sponsor the IDUG 


é mae www.correlog.com 
DB2 Tech Show, North America. Visit 


; +1 (239) 514-3331 
us in Austin at booth #300. Toll free U.S. (877) 267-7356 








QUY 
By2019, 47 \JA 

of organizations will have personal 
data stored onIT systems they 
don't own or control, 


The average large enterprise 
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installed on employee devices, 


Gartner says that by 2017, 
75 percent of mobile security 
breaches result from mobile 
application misconfiguration 
(gtnr.it/1OBjq3T). 

CISOs must take several 
measures to counteract this issue, 
but the first priority is to test 
their companies’ applications for 
security before they’re released. 
Why? Because unsecured 
applications are the biggest routes 
for intellectual property theft. 

As noted in the e-guide, 
“CISOs and the IT organizations 
struggling with mobilephobia 
know that, at some point, 
the apps will attack. Without 
changing the app development, 
app management and security 
testing processes, one day some 
innocent little icon may lead toa 
whole lot of trouble.” 











In our bring-your-own-device 
world, hordes of unmanaged 
mobile devices can access a 
company’s network. They could 
be infected with malware or 
worse, and IT staff has no way 
of knowing. 

“If you’re my employee, I can 
deploy an enterprise mobility 
management solution to manage 
your device,” Hardy says. “But 
if you’re a business partner or 
affiliate, that may not be an 
option, so suddenly, I’m opening 
up access to thousands of devices 
I can’t control.” 

Jailbroken or rooted devices 
that attempt to connect to the 
network present a particular 
threat. “These are devices that, 
through user tampering, have 
the inherent security of the 
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“If your users are accessing 
your company through mobile, you 
must embrace it and get ahead of it. 
Mobile is here; it’s happening, and 
you need a strategy.” 


—Jason Hardy 


device compromised, which can 
expose the enterprise to mobile 
threats,” he warns. 

It’s critical that the security 
solution can quickly identify 
and then limit or deny access 
from these devices. 

“Although the device barbarians 
may be at the gate, organizations 
need to let in only those that are 
deemed legitimate,” write the 
e-guide authors. “This scenario 
demands both access control/ 
management and improved user 
authentication. Without both 


Be Proactive 
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create a mobile security 
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systems in place, things become 
downright scary.” 


An ongoing fear is missing the 
warning signs about a new threat. 
It’s easy to do, considering all of 
the information and media we 
take in on a daily basis. 

“You have all of this information 
coming in—millions of records— 
and somewhere in those records 
could be information pointing to 
a malicious attack,” Hardy says. 
“How do you find that one needle 
in the haystack?” 

Speed and sophistication are 
essential. Organizations need 
security analytics tools that 
provide answers quickly. The tools 
must also be sophisticated enough 
to outsmart the hackers. 


Ultimately, companies must take 
a more integrated approach to 
mobile security. That means 
creating a mobile security 
strategy that includes five 
important areas: protecting 
devices, securing content and 
collaboration, safeguarding 
applications and data, managing 
access and fraud, and extending 
security intelligence. 
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of organizations currently 
employ 


It also means choosing the 
right partner. IBM Mobile Security 
offers a complete portfolio with 
integrated, one-view dashboards 
and functionality to secure all 
types of endpoints and networks. 

“Our main message is when 
you think about developing a 
mobile security strategy, don’t 
think about the challenges as 
point problems,” Hardy suggests. 
“Think about the full spectrum 
of threats, and take a holistic 
approach to addressing them.” 

He says most organizations 
are receiving this message well. 
But when mobilephobia kicks 
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said their security controls fall short 


,sucn as 
preventing malware and jailbreaks.' 





in, those same organizations 

can become paralyzed by fear 
instead of embracing mobile and 
implementing a comprehensive 
strategy. The longer they remain 
paralyzed, the greater their risk 
for threats and falling behind 
the competition. 

“If your users are accessing 
your company through mobile, 
you must embrace it and get 
ahead of it,” Hardy says. “Mobile 
is here; it’s happening, and you 
need a strategy.” 





Eve Daniels is a Minneapolis, 
Minnesota-based freelance writer. 
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IBM DB2 on 2/OS V2.2 features space and storage enhancements 


his article outlines IBM DB2* enhanced capabilities with z/OsS* V2.2, 

including easier movement and updates, more data set functions, and 

space and storage improvements. Part I of this article, “Database System 
synergy’ in the March/April issue (bit. ly/1Vif75W), highlights some of the 
features Z/OS 2.1 provides to DB2 for zZ/OS. 





John Iczkovits 
is a senior IT 
specialist with 

IBM Advanced 
Technical Support. 
He provides 

DB2 for 2/OS 
technical support 
and consulting 
services. His areas 
of expertise include 
DB2 data sharing, 
performance 

and availability. 


Easier Movement 
There was a time—long ago, when 
an IPL was required to add or 
delete an entry—when incorrectly 
updating the SYS1.PARMLIB 
subsystem name (SSN) table 
would require an IPL. Most 
customers perform IPLs with 
much less frequency, so it can 
take a while for an opportunity to 
occur to add a new DB2 subsystem 
or fix an entry for one in the SSN 
table. Entries can now be added 
dynamically, but with z/OS V2.2 
you can also delete an entry using 
the SETSSI command. 

Customers using FlashCopy* 
probably notice that dumping 
a large copy pool can take a 
considerable amount of time 
because all work is done from 
one LPAR. This includes dump 
(command, auto and fast 
replication) processing. z/OS 
V2.2 now has a new SETSYS 
command to distribute dump 
work across all hosts ina 
Sysplex-wide common dump 
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queue. This allows hierarchical 
storage management (HSM) to 
distribute workloads across host 
members in an HSMplex, and 
the new architecture allows for 
flexible configurations. The end 
result is the potential for the 
dump process to complete faster 
and possibly allow for FlashCopy 
to be executed more often. 

The class transition function 
in the management class 
debuted in z/OS V2.1, allowing 
transition of data between tiers 
and even down to the HSM 
migration level. For example, 

a DB2 partition that won’t be 
used frequently after 100 days 
is transitioned from SSD/Flash 
or HDD to a cheaper Serial 
ATA device. After 365 days, 
transition the data set to an 
HSM migration level 2 tape. 
This enhancement allows for 
cheaper, more efficient use of 
disk and tape. With z/OS 2.1, 
the class transition function 
is limited to automatic space 


management processing. With 
z/OS V2.2, the various MIGRATE 
commands are enhanced to 
support class transitions at the 
data set, volume and storage 
group level. 

Along with this change, the 
MIGRATE command can be used 
with the new STORAGEGROUP 
keyword to initiate migration 
for all volumes within a storage 
group in parallel. Up to 30 
storage groups may be specified. 
This is significant for DB2 
because it allows for such things 
as data sets in storage groups 
that contain image copy or 
archive log data sets to be created 
on disk and then migrated 
to tape via the MIGRATE 
STORAGEGROUP command. 


Data Set Improvements 
The Data Facility Storage 
Management Subsystem class 
transition function can now 
move data laterally in the same 
tier of storage in addition to 


moving it to a different tier’s 
storage. This enhancement 
allows data to be moved from 

a smaller to a larger disk and is 
especially helpful when moving 
data to extended address volume 
(EAV) volumes. 

Updating the expiration date of 
a single copy pool dump version is 
typically no easy task. It can take 
thousands of FIXCDS commands 
to resolve the problem. With z/OS 
V2.2, the UPDTCDS command 
will update the expiration date 
for a copy pool dump copy. This 
new command updates all of 
the control data set records that 
must be updated to reflect the 
new expiration date, including 
the fast replication dump record 
and the dump record for each 
volume dumped. 

Finding HSM and data set 
services (DSS) messages for 
a specific FRBACKUP or copy 
pool automatic dump can be 
challenging—find the correct 
log and search through all of the 
messages for all HSM activity. 
This can be like looking fora 
needle in a haystack for a busy 
HSM. With z/OS V2.2 and DB2 
12 (as a statement of direction), 
messages from such things as 
FRBACKUP and system-level 
backup (SLB) can be allocated to 
a specific data set. The output for 
tasks such as SLB will contain the 
data set name in which to find the 
associated messages. 

HSM APAR 0A47876 for z/OS 
V2.2 fixes a problem in the HSM 
interface for SLB—BACKUP 
SYSTEM, RESTORE SYSTEM 
and RECOVER. None of these 
utilities will work without the 
corresponding PTF applied. 

Generation data groups 
(GDG) are used by almost all 
z/OS customers and have been 
around for a long time. The 
GDG limitation of 255 data 
sets prevented customers from 
creating data sets daily and 


having a year’s worth of data 
available. With z/OS V2.2, GDG 
Extended (GDGE) can be created 
or altered to surpass 255 data 
sets, allowing for a maximum of 
999 data sets. All LPARs sharing 
GDGE should be at z/OS V2.2. 


IDCAMS DEFINE GDG defaults 
to NOSCRATCH, which can 
leave unwanted data sets when 
generation data sets (GDS) roll 
off. This is further complicated 
when users inadvertently put 
retention periods on their GDSes. 
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Systems administrators can 

now change this behavior and 
scratch data sets, even when 

the retention period has not yet 
been met. For Removable Media 
Manager (RMM) customers, the 
WHILECATALOG attribute for 
data sets allows users to specify 
whether data sets should be 
retained or expired by date when 
catalog entries for them exist. 
This is helpful for GDG data 
sets on tape. RMM customers 
can now use SEARCHDATASET 
and SEARCHVOLUME TSO 
commands to select records by 
creation date and time. 


ICF Flexibility 

When DB2 customers are looking 
at integrated catalog facility (ICF) 
performance or recovery-related 
issues, they often want to issue 
reporting types of commands 

to the catalog address space 
without modifying the catalog 
configuration. With z/OS V2.2, 

a new RACF* resource profile is 
checked by catalog command 
processing to ensure the issuer 
of a command is authorized to 
execute the command (e.g., have 
the authority to issue command 
F CATALOG,ALLOCATED but not 
F CATALOG,CLOSE(usercat) ). 

Other enhancements include 
the capability of DSS to restore 
an ICF user catalog to any 
volume serial number, not just 
where it was dumped. This 
applies to logical restores only. 
Restrictions for physical data set 
restore remain. 

Some DB2 customers ask for 
an IDCAMS REPRO MERGECAT 
(move or copy catalog entries 
from one ICF user catalog to 
another) to be executed. The 
output can be enormous, as it 
produces up to six lines for each 
entry processed. New keyword 
MESSAGELEVEL(ALL|SHORT) 
provides users a short version of 
the output. 


IDCAMS PRINT and REPRO 
functions can now process 
damaged VSAM control 
intervals or records using 
new keyword CIMODE. 


Space Allocation 

Storage Management Subsystem 
(SMS) has a handy feature in 
the data class called Space 
Constraint Relief (SCR). If the 
storage group doesn’t have 
enough space for a request on 
any volume, the requested space 
is reduced by the Interactive 
Storage Management Facility 
value Reduce Space Up To (%). 
For example, if SCR is set to 

10 percent and a DB2 data set 
would like to allocate 1,000 
cylinders, but no volume in 

the storage group has 1,000 
cylinders free, the request is 
automatically redriven at 900 
cylinders. With z/OS V2.2, this 
feature applies to data sets with 
the storage class specification 
of guaranteed space as well. A 
new sub-parameter, Guaranteed 
Space Reduction (Y|N), is 
added to the data class panel. 
Although DB2 user data sets 
generally shouldn’t have 
guaranteed space specified, 
this allows for the possibility 

of fewer space-related failures 
when specified. 

SCR can also be used for 
secondary space allocations. 
Prior to z/OS V2.2, if a secondary 
Space request was for 100 
cylinders and the volume didn’t 
have 100 cylinders, we hit the 
End of Volume command and 
chose another volume to extend 
to. With z/OS V2.2, we also use 
SCR for extents to reduce the 100 
cylinders to the SCR value. In our 
scenario, with the 100 cylinders 
secondary request and an SCR of 
4O percent, the allocation can be 
anything at or above 60 cylinders 
and can vary from time to time. 
If reduced, the allocation may be 
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60 cylinders, and at other times 
90 cylinders, but not below 60 
cylinders in this scenario. This 
support is for SMS-managed, 
non-striped VSAM data sets and 
non-VSAM data sets. 

From time to time, DB2 
customers may see space-related 
information in the DBM1 STC or 
other output, such as IDCAMS- 
related output. This message 
states that the cumulative space 
allocated on the selected storage 
group has exceeded HIGH value: 
IGD17380I STORAGE GROUP 
(sgname) IS ESTIMATED AT 
xx% OF CAPACITY, WHICH 
EXCEEDS ITS HIGH ALLOCATION 
THRESHOLD OF zz%. SMS 
now allows you to specify new 
storage group space warning 
thresholds separately from 
the high allocation threshold. 
New alert messages IGD400I 
and IGD401I will be issued to 
the console at an incremental 
interval when the alert threshold 
has been reached. IGD401I is 
issued only for volumes ina 
storage group containing one or 
more EAV volumes. This allows 
DB2 customers to set a lower 
threshold for warning messages, 
which can provide more time 
to react to storage group space 
shortage conditions. 

z/OS command D SMS has 
a new ALERT keyword that 
displays any storage group that 
has reached either the total 
space alert threshold or the 
track-managed alert threshold. 
This allows for added insurance 
when the high-exceeded 
messages are overlooked. 

Storage administrators 
sometimes struggle to keep 
the automatic class selection 
(ACS) routines in relative 
synch between test and 
production environments. 

SMS now provides a user- 
defined ACS read-only variable 
USER_ACSVAR used in SYS1. 


PARMLIB(IGDSMSxx) as well 
as in the ACS routines. This 
allows storage administrators 
to have one set of ACS routines 
but change USER_ACSVAR 
depending on the environment. 
This enhancement potentially 
results in fewer errors between 
environments due to ACS 
routine differences. 


Storage Updates 

Many IBM disk customers use 
Easy Tier* to manage data both 
between tiers and laterally 
within a tier. Executing a DB2 
REORG in a tiered environment 
caused problems. For example, 
some of the data set resided on 
an SSD, and some on an HDD; 
after the REORG we begin the 
learning curve again and start at 
the HDD level. z/OS 2.2 allows 
for DB2-related hints so this type 
of scenario doesn’t occur. DB2 
10 for z/OS and higher can take 
advantage of this enhancement, 
which can be retrofitted to z/OS 
2.1 with an APAR. 

Several other storage-related 
features are included in z/OS 
2.2 for Peer-to-Peer Remote 
Copy (PPRC)/Metro Mirror, 
such as Multi-Target PPRC, 
which allows a single volume 
to be the source for more than 
one PPRC relationship, and 
IBM zHyperWrite*: DS8870 
Log Write Accelerator for 
DB2, a new technology that 
combines DS8000* and z/OS 
enhancements that deliver 
performance benefits for 
writing operations to DB2 logs 
in the Metro Mirror (PPRC) 
environment. This reduces 
latency overhead, compared 
with normal storage-based 
synchronous mirroring. 

With z/OS 2.2 and storage, 
incremental FlashCopy supports 
up to 12 targets, instead of 
support of one for incremental 
FlashCopy for any individual 
volume. This prevents the 


need to define z/OS Global 
Mirror workload-based write 
pacing on a per-volume level, 
allowing greater flexibility in 
configurations. Some of these 
changes have also been retrofitted 
into previous z/OS versions. 


Enhanced Environments 

We have come a long way with z/OS, and 2.2 

offers great features and enhancements to manage 
environments. Legacy systems will benefit, as will 
integrating with the mobile and cloud environments 
on a z/OS system. z/OS has a bright future to 
continue to be a leader in technology. Ed 
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DOUBLING Security Efforts 


IBM Multi-Factor Authentication for Z/OS helps maintain a secure infrastructure 





n explosion of malicious attacks of increasing sophistication on computer 
systems has occurred recently. According to the “IBM 2015 Cyber Security 
Intelligence Index" (iom.co/1QGPp5u), in 2014, unauthorized access topped 
the list of incident categories affecting the top five industries named in this report, 
comprising about 37 percent of total incidents. The increased use of low-cost and 
powerful password cracking systems has made attacks much easier, placing the 
burden on organizations to increase their levels of defense. 








IBM Multi-Factor 


In addition, regulations such as 


and the 2014 Verizon Data 


Pacis Authentication (MFA) for PCI DSS and government ID cards __ Breach Investigation Report 
is responsible  Z/OS* provides a way to are driving the need for MFA asa (vz.to/1LUXJRR) states that use 
forzSystems raise the assurance level requirement for compliance. of stolen credentials has become 
pec tel of user authentication Mobile and cloud architectures a top threat, where 95 percent 


years of industry 
experience in 
servers, software 
and services, 
with a focus on 
risk and security 


to z/OS applications and 

hosting environments 

by allowing the use of 

multiple authentication factors. 
IBM MFA for z/OS is tightly 


make it imperative to reduce 

the risk of external threats, 
raising questions about the 
adequacy of password protection. 
Many passwords use common 


of incidents involve harvesting 
credentials stolen from customer 
devices and logging into Web 
applications with them. More 
than 1 billion personal data 


management. integrated with z/OS Security defaults that are easily guessed. records were reported stolen 
ian Server (RACF*), which stores Password vulnerabilities in 2014 alone, most of which 
Beene configuration and provisioning were named in several high contained user passwords 
project data, and provides an SMF audit profile hacks in recent years, (ibm.co/1UNZ3aW). 
management trail to track authentication 
professional, factors. IBM MFA can also help 
is z Systems . . _ . 
security offering Provide security administrators Multifactor 
manager with with the ability to enforce a ; ; 2 
19 yearsof — granular authentication policy sueiiel_ielslererile) sl 1s .4.9) fotbel fe 
experience ona per-user basis 
covering ; Bi alg=t-mr-\eqke)aow-le-mlel-/alsui(-\emr-tsmsal> mere) aal-le-iKe) al 
development, Nearly 60 percent of security rte eer 
test and product leaders interviewed in a 2014 IBM 
baad es all CISO assessment claim that the . Something you know (e.g., a password) 
on Bteails sophistication of attackers was . Something you have (e.g., a one-time password 
security. | Outstripping the sophistication (o) a= ej AV] e) Kole] a=) e)allem .<-\\0) 


of their organizations’ defenses 
(ibm.co/1pbkJ16). More than 80 
percent of security leaders have 
seen external threat increases 

in the past three years, and 

it’s currently viewed as a top 
challenge (see Figure 1, page 46). 
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—NIST publication SP 800-63-1 





IBM MFA for z/OS provides 
an additional tier of defense for 
authentication, reducing the 
likelihood that the perpetrator will 
have two or more factors lined up 
to gain access to critical systems. 


Various 

Credentials Needed 
MFA is a popular, agreed-upon 
method that uses a multitiered 
defense system to inhibit 
unauthenticated users from 
successfully accessing secured 
data or other assets. It combines 
several credentials, typically 
something the user knows and 
has, to provide additional tiers 
of defense (see “Multifactor 
Authentication Explained,” page 
44). With MFA, if one layer is 
compromised, other layers remain 
in place, presenting additional 
barriers to access. Multiple factors 
are possible; biometric data, 
such as fingerprint readers, can 
serve as another layer of defense. 
With the adoption of MFA, banks 
and financial institutions have 
increased confidence that only 
authorized users can access 
private, confidential data. 


IBM’s Implementation 
IBM MFA requires z/OS V2.1 or 
V2.2 and RSA Authentication 
Manager 8.1. IBM MFA for 
z/OS and RACF are designed 

to support both hardware- 

and software-based RSA 
SecurID tokens. By extending 
the RACF to enable multiple 
authentication factors, 
security administrators can 
enforce a granular multifactor 
authentication policy on a per- 
user-ID basis. 

Applications can support 
MFA as part of their existing 
RACF authentication process. 
MFA is integrated with System 
Authorization Facility and the 
RACF. When a user authenticates 
MFA with hard or soft tokens, 
the RSA Authentication 


Manager determines whether and as new authentication 
the user’s credentials are factors become available 
valid. If they are, MFA then they can be added without 
returns control to RACF to requiring changes to the 
resume the authentication base infrastructure. 

and authorization process. MFA support introduces 
The solution is extensible, extensions to a variety of 
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Because Java doesn’t follow the same rules as traditional COBOL 
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components in RACF. For 
instance, it stores MFA fields 

in user and resource profiles 
managed by new RACF 
commands and callable services. 
The RACF database serves as the 
data repository for MFA data for 
auditing and reporting purposes. 
Simple user commands allow 
the provisioning and definition 
of the acceptable tokens fora 
user. Tokens can be specified 
during user authentication 
requests, enabling MFA- 

aware applications to allow 

for factors in addition to 

RACF passwords. Auditing 
extensions track which factors 
were actually used during the 
authentication process. 


Phased Approach 

IBM delivered MFA 
enhancements in phases, 
beginning in February. The first 
MFA solution involved the use of 
RSA SecurID Tokens—hardware 
or software—that require an 
RSA SecurID server configured 
to the MFA server. SecurID 
Software tokens use the same 
algorithm used in popular RSA 
SecurID hardware tokens. (Many 
companies may find that the 
use of software tokens may be 
preferable to key fobs, however, 
as there are fewer physical 
assets to manage, and it’s easier 
to provision or de-provision 
users with software tokens.) The 
RSA SecurID solution requires 
the licensing of the RSA Secured 
Server, which can run on an 
x86-based platform. RSA tokens 
are available for a number of 
mobile platforms as well. 

In addition to the RSA 
support, IBM issued a 
statement of direction for future 
authentication factors and 
additional ecosystem support?: 


Figure 1: Biggest Challenges 


(over last three years) 


© 
D 
< 
= 
© 
= 
S 
& 
® 
m7 
© 
® 
— 
S 
£ 
o 
_ 
o 
E 
e 
t 
D 
e 
t= 
© 
L 
= 





More than 


1 billion 


personal data 
records were 
reported stolen 
in 2014 alone, 
most of which 
contained user 
passwords 
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% Indicating the most 
organizational effort to address 
(over next 3-5 years) 


1. The IBM TouchToken 
authentication, a Timed One 
Time use Password (TOTP) 
generator that enables 
strong authentication for 
iOS environments. The 
TOTP is evaluated on z/OS 
directly to ensure two-factor 
authentication is enforced. 

2. Personal Identity Verification/ 
Common Access Cards 
frequently used in government 
applications will be included. 

3. zSecure* support is intended 
to simplify administration 
by helping to enforce 
authentication policy, providing 
alert notifications and reporting 
on authentication audit events 
and compliance. 





Protection Today 
and Tomorrow 

IBM offers a highly flexible 
solution with RSA soft and 
hard token support. Multiple 
authentication methods are 
designed to be supported, and 
tight integration with RACF 
provides a consistent, policy- 
based, auditable approach. 

IBM MFA for z/OS can help 
clients accelerate deployment, 
simplify management 
and more easily address 
regulatory compliance. 

It can be used to secure mission- 
critical applications today as well 
as provide needed authentication 
to protect new mobile and cloud 
applications going forward. 4 


'- IBM’s statements regarding its plans, directions and intent are subject to change or withdrawal without notice at IBM’s sole discretion. 
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Universal Data Manager 
Dino-Software 


e Capability to easily manage, monitor, report on and maintain 
enterprise z/OS* storage from a centralized GUI with a global view 

e Extended automation, auditing, monitoring, reporting and control 
functions of data with point-and-click control for enterprise level 
storage objects 

e Capability to run a single command or job executed on all controlled 
systems, eliminating typical task and command library redundancies 

e Extensive reports using SQL filtering that can be generated, saved and 
executed on multiple systems in a single request, with output from all 
systems returned into the single GUI window 

e Message trapping and scheduling to ensure storage management can 
be automated as required and enable proactive alerting when critical 
storage conditions occur 

® Quick installation for immediate utilization and return on investment, 
fitting seamlessly into any data center, thanks to its flexible architecture 


© OS SUPPORT: z/OS 1.12 and above 
© PRICE: Variable 
© URL: dino-software.com 
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Illustration by Charles Williams 


OpenLegacy V3.0 
OpenLegacy 


e Acompiled API approach for security, flexibility 
and performance 

e Automatic API generation for a variety of 
back-end platforms, including mainframes, 
IBM i, JDBC databases and Web service 
description languages 

e Flexible deployment options: on-premises, on 
the cloud or to Docker-based cloud containers 

e API management, including lifecycle 
management and version control using 
any Eclipse-compatible tool 

e Enhanced security features, such as OAuth, 
data filtering and a dedicated secure gateway 


© OS SUPPORT: Windows” XP and above, Linux” 
© PRICE: Variable 
© URL: openlegacy.com 
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A Gen Z Mainframe 


Adventure 





19-year-old installs a z890 





PHOTO COURTESY OF CONNOR KRUKOSKY 


Gabe Goldberg 
has developed, 
worked with and 
written about 
technology 

for decades. 





in his parents’ basement 


oday’s typical young 
T adults are occupied with 

things like sports, arts, 
online/mobile games, social 
media apps and fashion. But 
Connor Krukosky isn’t your typical 
Gen Zer—he has a mainframe in 
his parents’ basement. 

An aspiring electrical engineer, 
19-year-old Krukosky acquired his 
first computer—what he believes 
is an IBM Aptiva—when he was 18 
months old and started collecting 
vintage machines about three 
years ago. In October 2015, a 
note on the members’ list of the 
then-named Mid-Atlantic Retro 
Computing Hobbyists group 
(yhoo.it/1nWefWB) announced, 
“TBM z890—Model 2086-320; 

= 1 EIEEL | bidding so far 

"tee $100,” andhe 

was hooked. 
Krukosky replied 
that he needed 
something 
to heat his 
basement and 
would definitely 
go for it. 





About the IBM z890 


Taliceto[U(er-10 WA\ ©) 4| my aur40]0)-ceental-M-LO)iam-lalalhVclést-|aVme) mins MeV] (>181/Ko1010 


Skeptics noted the system’s 
doorway-busting size and weight 
of over 1 ton, but he bid and the 
beast was his for a mere $237.39. 

The move included stripping 
everything from the z890 frame, 
using the family’s small flatbed 
trailer to transport it home and his 
supportive father excavating under 
their deck to slide the tight-fitting 
frame into the basement. 

Reassembly involved replacing 
damaged heatsink thermal 
compound, rewiring the z890 
from three-phase to single- 
phase and configuring the 
home’s power panel for 220 
volts. Hours of self-study and 
abundant advice from members 
of the IBM-MAIN discussion 
mailing list helped create an 
I/O configuration data set and 
define a new LPAR. Then came 
the need for storage, with fiber 
connectivity (FICON*)/ESCON 


mainframe—the z890 server replaced the z800 and allowed mid-size 
enterprise customers an option based on the z990 technology. Read more 
about the z890 in the System Overview: ibm.co/1PFrbaw. 
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Connor k ruk sky's ‘Tove for 
tage machines led to him 

purchasing aniBM z890. 
gear too expensive and bus and 
tag storage too hard to get. The 
solution was an IBM storage-area 
network (SAN) Data Gateway for 
storage; Linux® is installed but 
not yet running. 

After all that, the big VM 
or OS IPL hasn’t yet hap- 
pened. Fundamental Software 
(funsoft.com) is lending a 
FLEX-ES Control Unit Behavior 
ESCON emulator. 

An educated guess for the 
system’s original cost, a 2086- 
320 model with 8 GB of memory 
and appropriate I/O gear, was 
about $340,000. Krukosky’s total 
project cost so far is about $340, 
including thermal adhesive epoxy, 
cables, the SAN gateway ($11.84), 
etc., representing 0.1 percent of 
the cost of the new machine. 

IBMers have been informally 
helpful, and Krukosky is exploring 
whether z/VMx* and z/OS* versions 
might run. Next comes Internet 
accessibility via a 3270 SSH and 
a 3270 terminal via a 3174-61R 
establishment controller. 

With Krukosky representing 
the next mainframe generation, 
IBM z Systems* servers are in 
good hands for years to come. E4 
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FDR/UPSTREAM 


PROTECTING YOUR PENGUINS 







Data Protection for Linux on z Systems... 


© Provides reliable, file and system level 
data protection for Linux on z Systems 


© Leverages high performance z/OS 
mainframe media, including support 
for HiperSockets 


© Online database agents for Oracle, DB2, 
IBM Notes and Domino 


© Bare Metal recovery with UPSTREAM RESCUER 


© Support for z/OS UNIX, x86 Linux, UNIX and 
Windows clients 


And given that the Linux data is now on the 
System z mainframe who better than INNOVATION 
to provide the data protection too!! 


Using the tools and systems that you have been 
using tor decades, FDR/UPSTREAM integrates with 
your existing z/OS tape management, security and 
scheduling systems. 


REFERENCE POINT 


Global Events, Education, Resources for Mainframe 





Upcoming Events and Education 





MAY 9-12, 2016 

IBM Vision 2016 

Orlando, Florida 
ibmsystemsmag.com/mainframe/ 
events/IBM-Vision-2016/ 





MAY 11, 2016 

Gateway to Innovation 2016 
St. Louis, Missouri 
ibmsystemsmag.com/mainframe/ 
events/Gateway- 
to-Innovation-2016/ 





MAY 15-23, 2016 

Exploring the New Technical 
Capabilities of the IBM z13s 
and IBM 213 

Various Locations 
ibmsystemsmag.com/mainframe/ 
events/Exploring-the-New- 
Technical-Capabilities-of-the-IB/ 





MAY 16-19, 2016 

IBM Amplify 2016 

Tampa, Florida 
ibmsystemsmag.com/mainframe/ 
events/IBM-Amplify-2016/ 





JUNE 7, 2016 

Cloud Expo 

New York, New York 
ibmsystemsmag.com/mainframe/ 
events/Cloud-Expo/ 


iPad App 





JUNE 12-14, 2016 
Enterprise Computing 
Community Conference 
Poughkeepsie, New York 
ibmsystemsmag.com/mainframe/ 
events/Enterprise-Computing- 
Conference/ 





JUNE 23-25, 2016 

VM Workshop 2016 
Piscataway, New Jersey 
ibmsystemsmag.com/mainframe/ 
events/VM-Workshop-2016/ 





JUNE 28-JULY 1, 2016 

Red Hat Summit 

San Francisco, California 
ibmsystemsmag.com/mainframe/ 
events/Red-Hat-Summit/ 





AUGUST 22-24, 2016 
LinuxCon North America 
Toronto, Canada 
ibmsystemsmag.com/mainframe/ 
events/LinuxCon-North- 
America-%282%29/ 





SEPTEMBER 19-22, 2016 
IBM EDGE 

Las Vegas, Nevada 
ibmsystemsmag.com/mainframe/ 
events/IBM-Edge/ 
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© Subscribe Now EXTRA and 
Marketplace eNewsletters 


© Attend Now Live and On 
Demand Webinars 


© View Now 
Mainframe Videos 


© Search Now Find products 
and services in the online 
Solutions Edition 


Web Exclusive Features 


JES2 Job Execution Control Concurrent 
Job Support 
ibmsystemsmag.com/mainframe/ 
tipstechniques/systemsmanagement/ 
Concurrent-Job-Support/ 


What’s New in IMS Transaction Manager 
via the Service Process 
ibmsystemsmag.com/mainframe/administrator/ 
ims/Transaction-Manager-Service-Process/ 


Training and Information Resources Help 
to Stay Current on Skills 
ibmsystemsmag.com/mainframe/ 
tipstechniques/miscellaneous/training- 
information-resources/ 


Tokenized Encryption: Finding 

the Right Home 
ibmsystemsmag.com/mainframe/trends/ 
security/tokenized-encryption-home/ 


New Job Scheduling Functions in JCL 
ibmsystemsmag.com/mainframe/ 
tipstechniques/systemsmanagement/ 
SCHEDULE-JCL-statement/ 


DevOps Builds on Agile and Links 
Operations 
ibmsystemsmag.com/mainframe/trends/ 
Modernization/DevOps-operations/ 


IBM 213s Has Technical Capabilities 
for Today’s Business Environment 
ibmsystemsmag.com/mainframe/trends/ 
IBM-Announcements/technical-z13s/ 


DOWNLOAD NOW 
IBM Redbooks 


FIND HARDWARE, SOFTWARE, SERVICES AND EDUCATION 


2016 Mainframe Solutions Edition Product Index 


Make the most of your IBM Mainframe investment. 


This product index is your key to researching the vast array of 
hardware, software solutions, services and education in our 
PAURTOMIVllalicclantemere)lelle)asm melll(@)aMre\"cclicclel(om a lO iUMIAMYCclA(OUSMO)¢paTelisy 
including our digital and online guides. 


Poe-(eee scm iteiUlimelfelirlMVcveseaMeymUalem | Cellalitslanemere)(61l(0)aism mel 1t(0) eR 
go to: http://www.ibmsystemsmagmainframedigital.com/ 
nxtbooks/ibmsystemsmag/mainframe_20150910_se/ 


To access the online version of the Mainframe Solutions Edition, 


go to: ibmsystemsmag.com/buyersguide 





Hardware 


Appliances 
Prizm FICON to ESCON Converter 
iomsystemsmag.com/buyersguide/opticatechnologies 


Servers 

General (Administrator) 

IBM System z: EC12, BC12, 2196, 2114 
iomsystemsmag.com/buyersguide/topgun 


General 
IBM SAN Storage 
iomsystemsmag.com/buyersguide/topgun 


SAN (Storage) 
IBM and Brocade Connectivity Products 
iomsystemsmag.com/buyersguide/topgun 


Tape (Storage) 
ZVT Mainframe Virtual Tape 
iomsystemsmag.com/buyersguide/opticatechnologies 


Application 

Postal Software 

QCODE 
lomsystemsmag.com/buyersguide/qmsi 


QSORT 
lomsystemsmag.com/buyersguide/qmsi 
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QVIEW 
iomsystemsmag.com/buyersguide/qmsi 


Application Development 

Change Management 

ISPW Deploy 
iomsystemsmag.com/buyersguide/ispw 


ISPW Eclipse/Mobile/Browsers 
iomsystemsmag.com/buyersguide/ispw 


ISPW Enterprise SCM 
iomsystemsmag.com/buyersguide/ispw 


Serena ChangeMan ZMF 
iomsystemsmag.com/buyersguide/serena 


Serena Dimensions CM 
iomsystemsmag.com/buyersguide/serena 


Conversion Tools 
tcACCESS 
iomsystemsmag.com/buyersguide/treehousesoftware 


tcVISION 
iomsystemsmag.com/buyersguide/treehousesoftware 


Database Management 
enVue Data Virtualization Solution 
iomsystemsmag.com/buyersguide/gtsoftware 


General (Developer) 
Abend-AID 
iomsystemsmag.com/buyersguide/compuware 


AFP Conversion Module 
iomsystemsmag.com/buyersguide/mpitech 


Enterprise Print Manager 
iomsystemsmag.com/buyersguide/mpitech 


File-AlD 
iomsystemsmag.com/buyersguide/compuware 


Print SubSystem 
iomsystemsmag.com/buyersguide/mpitech 


Serena Deployment Automation 
iomsystemsmag.com/buyersguide/serena 


Serena Dimensions RM 
iomsystemsmag.com/buyersguide/serena 


Serena Release Control 
iomsystemsmag.com/buyersguide/serena 


Strobe 
iomsystemsmag.com/buyersguide/compuware 


Topaz 
iomsystemsmag.com/buyersguide/compuware 


GUI 
Capacity and Cost Planning Saas Project 
iomsystemsmag.com/buyersguide/zcostmanagement 


Virtel Web Modernization (VWM) 
iomsystemsmag.com/buyersguide/syspertec 


Modernization (Developer) 
DataNovata 
iomsystemsmag.com/buyersguide/treehousesoftware 


HostBridge 
iomsystemsmag.com/buyersguide/hostbridge 


Ivory Service Architect 
iomsystemsmag.com/buyersguide/gtsoftware 


OpenLegacy Community Edition 
lomsystemsmag.com/buyersguide/openlegacy 


OpenLegacy zSuite 
lomsystemsmag.com/buyersguide/openlegacy 


Test Management 
DataVantage DME (Data Masking Express) 
iomsystemsmag.com/buyersguide/datavantage 


DataVantage for z/0S 
iomsystemsmag.com/buyersguide/datavantage 


DataVantage Global 
iomsystemsmag.com/buyersguide/datavantage 


Web Enablement 
CCPTool 
iomsystemsmag.com/buyersguide/zcostmanagement 


HostBridge WIRE (Web Interface Rules Engine) 
iomsystemsmag.com/buyersguide/hostbridge 


Virtel Web Integration (VWI) 
iomsystemsmag.com/buyersguide/syspertec 


Cloud Computing 

General 

Fischer Identity Suite 
iomsystemsmag.com/buyersguide/fischerinternational 


Communications 

Connectivity 

SSR Server/Client 
iomsystemsmag.com/buyersguide/appliedsoftware 


Communications/Connectivity 

32/0 Emulation 

AutoSoftCapping 
iomsystemsmag.com/buyersguide/zcostmanagement 


Virtel Web Access (VWA) 
iomsystemsmag.com/buyersguide/syspertec 


File Transfer 
Mail2Z0S 
iomsystemsmag.com/buyersguide/casisoftware 


General 
Virtel Suite 
iomsystemsmag.com/buyersguide/sds 


Database 

General 

HostBridge Redis for z/OS 
iomsystemsmag.com/buyersguide/hostbridge 


IMS 


COPE for DBCTL 
iomsystemsmag.com/buyersguide/standardware 
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COPE for DCCTL 
iomsystemsmag.com/buyersguide/standardware 


COPE for IMS 
iomsystemsmag.com/buyersguide/standardware 


High Availability 

Data Replication (Administrator) 
FDRINSTANT for z/OS 
iomsystemsmag.com/buyersguide/innovation 


FDRMOVE with FDRPAS 
iomsystemsmag.com/buyersguide/innovation 


FDRPAS with optional ERASE for z/0S 
iomsystemsmag.com/buyersguide/innovation 


FDRPASVM 
iomsystemsmag.com/buyersguide/innovation 


General (Administrator) 
RTD 
lomsystemsmag.com/buyersguide/dinosoftware 


T-REX 
iomsystemsmag.com/buyersguide/dinosoftware 


UDM 
lomsystemsmag.com/buyersguide/dinosoftware 


Mirroring (Administrator) 
FDRPAS 
iomsystemsmag.com/buyersguide/innovation 


Linux on z Systems 

General (Trends) 

SUSE Linux Enterprise Server for System z 
iomsystemsmag.com/buyersguide/suse 


SUSE Studio 
iomsystemsmag.com/buyersguide/suse 


UPSTREAM RESERVOIR for Linux on z Systems 
iomsystemsmag.com/buyersguide/innovation 


Office Automation 

General (Administrator) 

CICS2PDF (zMakePDF) 
iomsystemsmag.com/buyersguide/casisoftware 


Total Automated Office (TAO) 
iomsystemsmag.com/buyersguide/fischerinternational 


z/XDC (Extended Debugging Controller) 
iomsystemsmag.com/buyersguide/colesoft 
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Printer Support 

General (Administrator) 

OMC Output Management Center 
iomsystemsmag.com/buyersguide/tonesoftware 


Supply Chain 

General (Administrator) 

Explorer GUI 
iomsystemsmag.com/buyersguide/dtssoftware 


Monitor 
iomsystemsmag.com/buyersguide/dtssoftware 


Systems Management 

Backup (Administrator) 

FDRSOS network-free DR protection for your Linux 
on z Systems cloud 

iomsystemsmag.com/buyersguide/innovation 


FDR/UPSTREAM for Linux on z Systems 
iomsystemsmag.com/buyersguide/innovation 


FDR/UPSTREAM z/OS data protection for your 
open-systems cloud 
iomsystemsmag.com/buyersguide/innovation 


SOSINSTANT nondisruptive z System DR protection 
for your Linux on z Systems cloud 
iomsystemsmag.com/buyersguide/innovation 


TapeSTREAM Virtual Tape Solution 
iomsystemsmag.com/buyersguide/fischerinternational 


Compliance 
eventACTION 
iomsystemsmag.com/buyersguide/actionsoftware 


ussACTION 
iomsystemsmag.com/buyersguide/actionsoftware 


Disaster Recovery 
Recoverability Assessment Service 
iomsystemsmag.com/buyersguide/21 stcentury 


UPSTREAM/SOS network-free, file-level protection 
for your Linux on z Systems cloud 
iomsystemsmag.com/buyersguide/innovation 


UPSTREAM RESERVOIR for distributed open-systems 
cloud data protection 
iomsystemsmag.com/buyersguide/innovation 


VFI 
iomsystemsmag.com/buyersguide/21 stcentury 


General 
Vanguard Professional Services 
iomsystemsmag.com/buyersguide/vanguard 


Vanguard Security and Compliance Solutions 
iomsystemsmag.com/buyersguide/vanguard 


Vanguard Staff Augmentation Services 
iomsystemsmag.com/buyersguide/vanguard 
General (Administrator) 

DLm Control Center (DCC) 
iomsystemsmag.com/buyersguide/dtssoftware 


EASY/Exit 
iomsystemsmag.com/buyersguide/dtssoftware 


FDRViEWS 
iomsystemsmag.com/buyersguide/innovation 


Serena ChangeMan SSM 
iomsystemsmag.com/buyersguide/serena 


SMS/Debug 
iomsystemsmag.com/buyersguide/dtssoftware 


Space Recovery System (SRS) 
iomsystemsmag.com/buyersguide/dtssoftware 


SUSE Manager 
iomsystemsmag.com/buyersguide/suse 


VitalSigns 
iomsystemsmag.com/buyersguide/sds 


General (Developer) 
Hiperstation 
iomsystemsmag.com/buyersguide/compuware 


Xpediter 
iomsystemsmag.com/buyersguide/compuware 


Help Desk (Administrator) 
ReACT 
iomsystemsmag.com/buyersguide/aspg 


Job Management 
IOF JES2 Job Management 


iomsystemsmag.com/buyersguide/fischerinternational 


ZOSEM HSM Reporting and Optimizer 
iomsystemsmag.com/buyersguide/trident 


Job Scheduling 
ZOSEM for Software Cost Reduction 
iomsystemsmag.com/buyersguide/trident 


Performance (Administrator) 
EasySMF 
iomsystemsmag.com/buyersguide/blackhillsoftware 


HostBridge for ziIP 
iomsystemsmag.com/buyersguide/hostbridge 


HostBridge Socket Support 
iomsystemsmag.com/buyersguide/hostbridge 


IAM and IAM/PLEX 
iomsystemsmag.com/buyersguide/innovation 


IntelliMagic Direction for z/OS 
lomsystemsmag.com/buyersguide/intellimagic 


IntelliMagic Vision for z/OS 
iomsystemsmag.com/buyersguide/intellimagic 


JavaSMF 
iomsystemsmag.com/buyersguide/blackhillsoftware 


zDynaCap 
iomsystemsmag.com/buyersguide/sds 


Report Management 
JES2Mail / JES2FTP 
iomsystemsmag.com/buyersguide/casisoftware 


Security 
Data Encryption Facility (DEF) 
iomsystemsmag.com/buyersguide/appliedsoftware 


Vanguard Governance Risk 
and Compliance Software 
iomsystemsmag.com/buyersguide/vanguard 


Vanguard Identity 
and Access Management Software 
iomsystemsmag.com/buyersguide/vanguard 


Security (Administrator) 
Absolute Proof 
iomsystemsmag.com/buyersguide/fischerinternational 


CorreLog dbDefender for DB2 
iomsystemsmag.com/buyersguide/correlog 


CorreLog SIEM Agent for IBM z/OS Mainframes 
lomsystemsmag.com/buyersguide/correlog 


CorreLog Visualizer for IBM z/OS 
lomsystemsmag.com/buyersguide/correlog 
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ERQ — Easy RACF Query 
iomsystemsmag.com/buyersguide/aspg 


FDRERASE for z/OS 
iomsystemsmag.com/buyersguide/innovation 


Security/Encryption 
MegaCryption 
iomsystemsmag.com/buyersguide/aspg 


Spool File Management 
OMC-FLASH 
iomsystemsmag.com/buyersguide/tonesoftware 


Storage Management 
SpaceFinder Storage Management Solutions 
iomsystemsmag.com/buyersguide/21stcentury 


Total Storage 
iomsystemsmag.com/buyersguide/21stcentury 


Tape Migration 
Migration in Place 
iomsystemsmag.com/buyersguide/21stcentury 


Tape/Assist 
iomsystemsmag.com/buyersguide/21stcentury 


Tape Management 
FATSCOPY 
iomsystemsmag.com/buyersguide/innovation 


IntelliMagic Vision for z/OS Tape and Virtual Tape 


iomsystemsmag.com/buyersguide/intellimagic 


Tools and Utilities 

General 

TSO Superset Utilities 
iomsystemsmag.com/buyersguide/appliedsoftware 


General (Developer) 
DYNA-STEP 
iomsystemsmag.com/buyersguide/tonesoftware 


STEPLIB-Rx 
iomsystemsmag.com/buyersguide/tonesoftware 


ThruPut Manager 
iomsystemsmag.com/buyersguide/mvs-solutions 
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Classroom 

General 

Vanguard Security and Compliance Training 
iomsystemsmag.com/buyersguide/vanguard 


Consulting 

General (Trends) 

z/OS Systems Consulting 
iomsystemsmag.com/buyersguide/trident 


